Edit tour

Windows Analysis Report
INV00987890.exe

Overview

General Information

Sample Name:	INV00987890.exe
Analysis ID:	635170
MD5:	fe5cab253ef5708d03dd6970e105b6c6
SHA1:	d7d0ba487169c56e33e92064b482c2d56d5dba5e
SHA256:	80f5923e2037f3596f2bebec849a1a55221c37c714d14eca6bdd35e12351ec7d
Tags:	agentteslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Modifies the hosts file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains very large array initializations

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Drops certificate files (DER)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

INV00987890.exe (PID: 6468 cmdline: "C:\Users\user\Desktop\INV00987890.exe" MD5: FE5CAB253EF5708D03DD6970E105B6C6)

INV00987890.exe (PID: 6764 cmdline: {path} MD5: FE5CAB253EF5708D03DD6970E105B6C6)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "info@maviksel.com", "Password": "Ravi/1970", "Host": "mail.maviksel.com"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.526824095.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.526824095.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.295217525.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.295217525.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.296078130.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.296078130.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.295669546.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.295669546.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.296713839.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.296713839.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.306417687.000000000345F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.306417687.000000000345F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: INV00987890.exe PID: 6468	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: INV00987890.exe PID: 6468	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: INV00987890.exe PID: 6764	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: INV00987890.exe PID: 6764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.INV00987890.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.INV00987890.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.INV00987890.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32cab:$s10: logins 0x32712:$s11: credential 0x2ecd3:$g1: get_Clipboard 0x2ece1:$g2: get_Keyboard 0x2ecee:$g3: get_Password 0x2ffeb:$g4: get_CtrlKeyDown 0x2fffb:$g5: get_ShiftKeyDown 0x3000c:$g6: get_AltKeyDown
4.0.INV00987890.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.INV00987890.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.INV00987890.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32cab:$s10: logins 0x32712:$s11: credential 0x2ecd3:$g1: get_Clipboard 0x2ece1:$g2: get_Keyboard 0x2ecee:$g3: get_Password 0x2ffeb:$g4: get_CtrlKeyDown 0x2fffb:$g5: get_ShiftKeyDown 0x3000c:$g6: get_AltKeyDown
4.0.INV00987890.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.INV00987890.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.INV00987890.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32cab:$s10: logins 0x32712:$s11: credential 0x2ecd3:$g1: get_Clipboard 0x2ece1:$g2: get_Keyboard 0x2ecee:$g3: get_Password 0x2ffeb:$g4: get_CtrlKeyDown 0x2fffb:$g5: get_ShiftKeyDown 0x3000c:$g6: get_AltKeyDown
0.2.INV00987890.exe.3599a00.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.INV00987890.exe.3599a00.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.INV00987890.exe.3599a00.2.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xb02cb:$s10: logins 0xafd32:$s11: credential 0xac2f3:$g1: get_Clipboard 0xac301:$g2: get_Keyboard 0xac30e:$g3: get_Password 0xad60b:$g4: get_CtrlKeyDown 0xad61b:$g5: get_ShiftKeyDown 0xad62c:$g6: get_AltKeyDown
4.0.INV00987890.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.INV00987890.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.INV00987890.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32cab:$s10: logins 0x32712:$s11: credential 0x2ecd3:$g1: get_Clipboard 0x2ece1:$g2: get_Keyboard 0x2ecee:$g3: get_Password 0x2ffeb:$g4: get_CtrlKeyDown 0x2fffb:$g5: get_ShiftKeyDown 0x3000c:$g6: get_AltKeyDown
0.2.INV00987890.exe.3553fa0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.INV00987890.exe.3553fa0.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.INV00987890.exe.3553fa0.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30eab:$s10: logins 0x30912:$s11: credential 0x2ced3:$g1: get_Clipboard 0x2cee1:$g2: get_Keyboard 0x2ceee:$g3: get_Password 0x2e1eb:$g4: get_CtrlKeyDown 0x2e1fb:$g5: get_ShiftKeyDown 0x2e20c:$g6: get_AltKeyDown
4.2.INV00987890.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.INV00987890.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.INV00987890.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32cab:$s10: logins 0x32712:$s11: credential 0x2ecd3:$g1: get_Clipboard 0x2ece1:$g2: get_Keyboard 0x2ecee:$g3: get_Password 0x2ffeb:$g4: get_CtrlKeyDown 0x2fffb:$g5: get_ShiftKeyDown 0x3000c:$g6: get_AltKeyDown
4.0.INV00987890.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.INV00987890.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.INV00987890.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32cab:$s10: logins 0x32712:$s11: credential 0x2ecd3:$g1: get_Clipboard 0x2ece1:$g2: get_Keyboard 0x2ecee:$g3: get_Password 0x2ffeb:$g4: get_CtrlKeyDown 0x2fffb:$g5: get_ShiftKeyDown 0x3000c:$g6: get_AltKeyDown
0.2.INV00987890.exe.3553fa0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.INV00987890.exe.3553fa0.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.INV00987890.exe.3553fa0.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32cab:$s10: logins 0xf5d2b:$s10: logins 0x32712:$s11: credential 0xf5792:$s11: credential 0x2ecd3:$g1: get_Clipboard 0xf1d53:$g1: get_Clipboard 0x2ece1:$g2: get_Keyboard 0xf1d61:$g2: get_Keyboard 0x2ecee:$g3: get_Password 0xf1d6e:$g3: get_Password 0x2ffeb:$g4: get_CtrlKeyDown 0xf306b:$g4: get_CtrlKeyDown 0x2fffb:$g5: get_ShiftKeyDown 0xf307b:$g5: get_ShiftKeyDown 0x3000c:$g6: get_AltKeyDown 0xf308c:$g6: get_AltKeyDown
Click to see the 22 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.0.INV00987890.exe.400000.12.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "info@maviksel.com", "Password": "Ravi/1970", "Host": "mail.maviksel.com"}

Multi AV Scanner detection for submitted file

Source: INV00987890.exe	Virustotal: Detection: 30%			Perma Link
Source: INV00987890.exe	ReversingLabs: Detection: 26%

Machine Learning detection for sample

Source: INV00987890.exe

Joe Sandbox ML: detected

Source: 4.0.INV00987890.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.INV00987890.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.2.INV00987890.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.INV00987890.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.INV00987890.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.INV00987890.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8

Source: INV00987890.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: INV00987890.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\INV00987890.exe

Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h

0_2_04442238

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View	IP Address: 162.215.253.210 162.215.253.210
Source: Joe Sandbox View	IP Address: 162.215.253.210 162.215.253.210

Source: global traffic

TCP traffic: 192.168.2.3:49753 -> 162.215.253.210:587

Source: global traffic

TCP traffic: 192.168.2.3:49753 -> 162.215.253.210:587

Source: INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://NEjfKK.com
Source: INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: INV00987890.exe, 00000004.00000003.346614551.0000000006A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?dfa321c85cb10
Source: INV00987890.exe, 00000000.00000003.265410217.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.maviksel.com
Source: INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://maviksel.com
Source: INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: INV00987890.exe, 00000000.00000003.271107327.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.270816122.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.270557812.00000000053DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000002.308767318.00000000053D0000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.298547621.00000000053D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: INV00987890.exe, 00000000.00000003.278527778.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278472905.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.281901697.0000000005402000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.279181554.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.280387812.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.281286258.000000000540D000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.280312610.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278741035.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.281875487.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278224495.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.280120374.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.279720695.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278188080.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278682189.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.279603178.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278155597.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278710128.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.279112580.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278278704.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.279325032.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.281707943.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/de
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: INV00987890.exe, 00000000.00000003.275437800.0000000005405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: INV00987890.exe, 00000000.00000003.276526018.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275998575.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277261918.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276292788.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277989711.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276145647.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275621528.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276978947.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277921796.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277735473.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276553761.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275946542.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276699756.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277295426.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275437800.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277761576.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276877803.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275842686.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275718248.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275888860.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276098140.0000000005405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlp
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: INV00987890.exe, 00000000.00000002.308767318.00000000053D0000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.298547621.00000000053D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comM
Source: INV00987890.exe, 00000000.00000002.308767318.00000000053D0000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.298547621.00000000053D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalsdw
Source: INV00987890.exe, 00000000.00000003.274943515.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275367663.00000000053DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcom
Source: INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: INV00987890.exe, 00000000.00000003.274943515.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275367663.00000000053DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdw
Source: INV00987890.exe, 00000000.00000003.273991474.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.274943515.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comeM
Source: INV00987890.exe, 00000000.00000003.274943515.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275367663.00000000053DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.commn
Source: INV00987890.exe, 00000000.00000003.274943515.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275367663.00000000053DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comueta
Source: INV00987890.exe, 00000000.00000003.265029682.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264949600.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: INV00987890.exe, 00000000.00000003.265099327.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.265126207.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comic
Source: INV00987890.exe, 00000000.00000003.265029682.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comnr2
Source: INV00987890.exe, 00000000.00000003.265029682.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264949600.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comnte
Source: INV00987890.exe, 00000000.00000003.267436367.00000000053D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.c
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.267409325.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: INV00987890.exe, 00000000.00000003.267836467.00000000053D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: INV00987890.exe, 00000000.00000003.267409325.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnR
Source: INV00987890.exe, 00000000.00000003.267836467.00000000053D4000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.267986661.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.267436367.00000000053D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnk
Source: INV00987890.exe, 00000000.00000003.267409325.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cns-m
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: INV00987890.exe, 00000000.00000003.264890640.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: INV00987890.exe, 00000000.00000003.265029682.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.265085729.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264743780.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264685681.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264814672.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264852176.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264630003.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264949600.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264890640.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.coma-d%
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.266564650.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: INV00987890.exe, 00000000.00000003.266564650.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.krati
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: INV00987890.exe, 00000000.00000003.265410217.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.265488221.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comA
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de.
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.dem
Source: INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 2D85F72862B55C4EADD9E66E06947F3D0.4.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: INV00987890.exe, 00000004.00000002.531371637.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://BJANwyE880kOV.net
Source: INV00987890.exe, 00000004.00000003.317448459.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://BJANwyE880kOV.net853321935-2125563209-4053062332-1002_Classes
Source: INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%
Source: INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%%startupfolder%
Source: INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

DNS traffic detected: queries for: mail.maviksel.com

Source: C:\Users\user\Desktop\INV00987890.exe

File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\Desktop\INV00987890.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.0.INV00987890.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.INV00987890.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.INV00987890.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.INV00987890.exe.3599a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.INV00987890.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.INV00987890.exe.3553fa0.3.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.2.INV00987890.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.INV00987890.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.INV00987890.exe.3553fa0.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen

.NET source code contains very large array initializations

Source: 4.0.INV00987890.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b9D560B71u002d2988u002d400Cu002d92B2u002d2C1BD4F0ACA8u007d/D737A0A3u002d8909u002d437Bu002d9EF9u002d27AF18FE1A5A.cs	Large array initialization: .cctor: array initializer size 11666
Source: 4.0.INV00987890.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007b9D560B71u002d2988u002d400Cu002d92B2u002d2C1BD4F0ACA8u007d/D737A0A3u002d8909u002d437Bu002d9EF9u002d27AF18FE1A5A.cs	Large array initialization: .cctor: array initializer size 11666
Source: 4.2.INV00987890.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b9D560B71u002d2988u002d400Cu002d92B2u002d2C1BD4F0ACA8u007d/D737A0A3u002d8909u002d437Bu002d9EF9u002d27AF18FE1A5A.cs	Large array initialization: .cctor: array initializer size 11666
Source: 4.0.INV00987890.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007b9D560B71u002d2988u002d400Cu002d92B2u002d2C1BD4F0ACA8u007d/D737A0A3u002d8909u002d437Bu002d9EF9u002d27AF18FE1A5A.cs	Large array initialization: .cctor: array initializer size 11666
Source: 4.0.INV00987890.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b9D560B71u002d2988u002d400Cu002d92B2u002d2C1BD4F0ACA8u007d/D737A0A3u002d8909u002d437Bu002d9EF9u002d27AF18FE1A5A.cs	Large array initialization: .cctor: array initializer size 11666

Source: INV00987890.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 4.0.INV00987890.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.INV00987890.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.INV00987890.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.INV00987890.exe.3599a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.INV00987890.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.INV00987890.exe.3553fa0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.2.INV00987890.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.INV00987890.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.INV00987890.exe.3553fa0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload

Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 0_2_0016A11D	0_2_0016A11D
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 0_2_0232E560	0_2_0232E560
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 0_2_0232E550	0_2_0232E550
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 0_2_0232BCD4	0_2_0232BCD4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 0_2_04440346	0_2_04440346
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 0_2_0016644E	0_2_0016644E
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_00E3A11D	4_2_00E3A11D
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_016EF378	4_2_016EF378
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_016EF6C0	4_2_016EF6C0
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_016E6563	4_2_016E6563
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_0698AFF4	4_2_0698AFF4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_0698F8B8	4_2_0698F8B8
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_06985430	4_2_06985430
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_0698D9E0	4_2_0698D9E0
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069832A8	4_2_069832A8
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069CE0F0	4_2_069CE0F0
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069C8580	4_2_069C8580
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069CE08C	4_2_069CE08C
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069C9458	4_2_069C9458
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069C0390	4_2_069C0390
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069C93A8	4_2_069C93A8
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069CCFD8	4_2_069CCFD8
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_00E3644E	4_2_00E3644E

Source: INV00987890.exe	Binary or memory string: OriginalFilename vs INV00987890.exe
Source: INV00987890.exe, 00000000.00000002.309658003.0000000006D60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs INV00987890.exe
Source: INV00987890.exe, 00000000.00000002.301301141.0000000002441000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs INV00987890.exe
Source: INV00987890.exe, 00000000.00000002.301301141.0000000002441000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevBtkGzLyUSgdZHxyNbFIvFKJMAULdLJZTRI.exe4 vs INV00987890.exe
Source: INV00987890.exe, 00000000.00000000.257615533.0000000000162000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTNVeK.exe8 vs INV00987890.exe
Source: INV00987890.exe, 00000000.00000002.306417687.000000000345F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevBtkGzLyUSgdZHxyNbFIvFKJMAULdLJZTRI.exe4 vs INV00987890.exe
Source: INV00987890.exe, 00000000.00000002.306417687.000000000345F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs INV00987890.exe
Source: INV00987890.exe, 00000000.00000002.304708028.00000000027F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs INV00987890.exe
Source: INV00987890.exe	Binary or memory string: OriginalFilename vs INV00987890.exe
Source: INV00987890.exe, 00000004.00000002.526824095.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevBtkGzLyUSgdZHxyNbFIvFKJMAULdLJZTRI.exe4 vs INV00987890.exe
Source: INV00987890.exe, 00000004.00000000.296745637.0000000000E32000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTNVeK.exe8 vs INV00987890.exe
Source: INV00987890.exe, 00000004.00000002.528045461.00000000012F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs INV00987890.exe
Source: INV00987890.exe	Binary or memory string: OriginalFilenameTNVeK.exe8 vs INV00987890.exe

Source: INV00987890.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: INV00987890.exe	Virustotal: Detection: 30%
Source: INV00987890.exe	ReversingLabs: Detection: 26%

Source: INV00987890.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\INV00987890.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\INV00987890.exe "C:\Users\user\Desktop\INV00987890.exe"
Source: C:\Users\user\Desktop\INV00987890.exe	Process created: C:\Users\user\Desktop\INV00987890.exe {path}
Source: C:\Users\user\Desktop\INV00987890.exe	Process created: C:\Users\user\Desktop\INV00987890.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\INV00987890.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\INV00987890.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INV00987890.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@3/6@3/1

Source: INV00987890.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\INV00987890.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe

Mutant created: \Sessions\1\BaseNamedObjects\kfUWHizl

Source: 4.0.INV00987890.exe.400000.12.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.INV00987890.exe.400000.12.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.INV00987890.exe.400000.8.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.INV00987890.exe.400000.8.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.INV00987890.exe.400000.0.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.INV00987890.exe.400000.0.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\INV00987890.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: INV00987890.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: INV00987890.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 0_2_0016BA89 push ss; retf	0_2_0016BA8A
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 0_2_0444307D push FFFFFF8Bh; iretd	0_2_04443087
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_00E3BA89 push ss; retf	4_2_00E3BA8A
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069832A8 push es; iretd	4_2_069840B0
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069832A8 push es; iretd	4_2_06984148
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_0698179A push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_06981792 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_0698178E push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_06981782 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069817B9 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069817B2 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069817AA push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069817A1 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069817DA push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069817D1 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069817CA push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_0698A3C0 push es; ret	4_2_0698A3D0
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069817C2 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069817EA push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069817E2 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_0698177A push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069818BD push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069840B1 push es; iretd	4_2_06984148
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_069818DD push es; ret	4_2_06981910
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_0698181A push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_06981816 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_06981832 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_0698182A push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_06981826 push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_0698187E push es; ret	4_2_069818C4
Source: C:\Users\user\Desktop\INV00987890.exe	Code function: 4_2_06981872 push es; ret	4_2_069818C4

Source: initial sample

Static PE information: section name: .text entropy: 7.4693135193

Source: C:\Users\user\Desktop\INV00987890.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: INV00987890.exe PID: 6468, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\INV00987890.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\INV00987890.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\INV00987890.exe TID: 6560	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe TID: 244	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe TID: 5264	Thread sleep count: 4935 > 30	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe TID: 5264	Thread sleep count: 3609 > 30	Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe	Window / User API: threadDelayed 4935			Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Window / User API: threadDelayed 3609			Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\INV00987890.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\INV00987890.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: INV00987890.exe, 00000004.00000002.533642050.0000000006A50000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000004.00000002.533756870.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000004.00000003.346614551.0000000006A69000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000004.00000003.345689651.0000000006A7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: INV00987890.exe, 00000000.00000002.304517618.00000000027B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\INV00987890.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe

Code function: 4_2_069CB228 LdrInitializeThunk,

4_2_069CB228

Source: C:\Users\user\Desktop\INV00987890.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Modifies the hosts file

Source: C:\Users\user\Desktop\INV00987890.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe

Process created: C:\Users\user\Desktop\INV00987890.exe {path}

Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Users\user\Desktop\INV00987890.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Users\user\Desktop\INV00987890.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\INV00987890.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\Desktop\INV00987890.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.0.INV00987890.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.INV00987890.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.INV00987890.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV00987890.exe.3599a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.INV00987890.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV00987890.exe.3553fa0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.INV00987890.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.INV00987890.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV00987890.exe.3553fa0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.526824095.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.295217525.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.296078130.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.295669546.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.296713839.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.306417687.000000000345F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV00987890.exe PID: 6468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: INV00987890.exe PID: 6764, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\INV00987890.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\INV00987890.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\INV00987890.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\INV00987890.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\INV00987890.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV00987890.exe PID: 6764, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.0.INV00987890.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.INV00987890.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.INV00987890.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV00987890.exe.3599a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.INV00987890.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV00987890.exe.3553fa0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.INV00987890.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.INV00987890.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV00987890.exe.3553fa0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.526824095.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.295217525.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.296078130.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.295669546.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.296713839.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.306417687.000000000345F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV00987890.exe PID: 6468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: INV00987890.exe PID: 6764, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	1 Credentials in Registry	211 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	131 Virtualization/Sandbox Evasion	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	11 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	114 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	3 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
INV00987890.exe	31%	Virustotal	Browse
INV00987890.exe	27%	ReversingLabs
INV00987890.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.0.INV00987890.exe.400000.12.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.INV00987890.exe.400000.8.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.2.INV00987890.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.INV00987890.exe.400000.6.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.INV00987890.exe.400000.10.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.INV00987890.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
maviksel.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cnR	0%	URL Reputation	safe
https://BJANwyE880kOV.net	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.founder.c	0%	URL Reputation	safe
https://api.ipify.org%%startupfolder%	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.tiro.comA	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fonts.comic	0%	URL Reputation	safe
http://www.founder.com.cn/cnk	0%	URL Reputation	safe
http://www.fonts.comnr2	0%	Avira URL Cloud	safe
http://www.urwpp.de.	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://www.fontbureau.comcom	0%	URL Reputation	safe
http://NEjfKK.com	0%	Avira URL Cloud	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://www.fontbureau.commn	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.krati	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.fontbureau.comalsdw	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://api.ipify.org%	0%	URL Reputation	safe
http://maviksel.com	0%	Avira URL Cloud	safe
http://x1.i.lencr.org/	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.sajatypeworks.coma-d%	0%	Avira URL Cloud	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://www.fontbureau.comueta	0%	URL Reputation	safe
http://www.fontbureau.comM	0%	Avira URL Cloud	safe
http://www.fontbureau.comdw	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	URL Reputation	safe
http://www.fonts.comnte	0%	Avira URL Cloud	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.comd	0%	URL Reputation	safe
http://www.fontbureau.comeM	0%	Avira URL Cloud	safe
http://mail.maviksel.com	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
https://BJANwyE880kOV.net853321935-2125563209-4053062332-1002_Classes	0%	Avira URL Cloud	safe
http://www.fontbureau.comalic	0%	URL Reputation	safe
http://www.urwpp.dem	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cns-m	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
maviksel.com	162.215.253.210	true	true	0%, Virustotal, Browse	unknown
x1.i.lencr.org	unknown	unknown	false		unknown
mail.maviksel.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnR	INV00987890.exe, 00000000.00000003.267409325.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://BJANwyE880kOV.net	INV00987890.exe, 00000004.00000002.531371637.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.c	INV00987890.exe, 00000000.00000003.267436367.00000000053D4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%%startupfolder%	INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://www.goodfont.co.kr	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	INV00987890.exe, 00000000.00000003.271107327.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.270816122.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.270557812.00000000053DD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comA	INV00987890.exe, 00000000.00000003.265410217.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.265488221.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0	INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	INV00987890.exe, 00000000.00000003.264890640.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	INV00987890.exe, 00000000.00000003.265410217.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comic	INV00987890.exe, 00000000.00000003.265099327.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.265126207.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnk	INV00987890.exe, 00000000.00000003.267836467.00000000053D4000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.267986661.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.267436367.00000000053D4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comnr2	INV00987890.exe, 00000000.00000003.265029682.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.de.	INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comcom	INV00987890.exe, 00000000.00000003.274943515.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275367663.00000000053DA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://NEjfKK.com	INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.o.lencr.org0	INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.commn	INV00987890.exe, 00000000.00000003.274943515.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275367663.00000000053DA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.krati	INV00987890.exe, 00000000.00000003.266564650.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	INV00987890.exe, 00000000.00000003.265029682.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264949600.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.266564650.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.de	INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comalsdw	INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%	INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://www.fontbureau.com/de	INV00987890.exe, 00000000.00000003.278527778.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278472905.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.281901697.0000000005402000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.279181554.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.280387812.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.281286258.000000000540D000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.280312610.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278741035.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.281875487.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278224495.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.280120374.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.279720695.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278188080.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278682189.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.279603178.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278155597.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278710128.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.279112580.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.278278704.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.279325032.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.281707943.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://maviksel.com	INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000002.308767318.00000000053D0000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.298547621.00000000053D0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.4.dr	false	URL Reputation: safe	unknown
http://www.fontbureau.comF	INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.coma-d%	INV00987890.exe, 00000000.00000003.265029682.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.265085729.00000000053F4000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264743780.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264685681.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264814672.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264852176.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264630003.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264949600.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264890640.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers/cabarga.htmlp	INV00987890.exe, 00000000.00000003.276526018.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275998575.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277261918.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276292788.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277989711.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276145647.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275621528.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276978947.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277921796.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277735473.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276553761.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275946542.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276699756.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277295426.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275437800.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.277761576.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276877803.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275842686.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275718248.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275888860.0000000005405000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.276098140.0000000005405000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cps.letsencrypt.org0	INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comueta	INV00987890.exe, 00000000.00000003.274943515.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275367663.00000000053DA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comM	INV00987890.exe, 00000000.00000002.308767318.00000000053D0000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.298547621.00000000053D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comdw	INV00987890.exe, 00000000.00000003.274943515.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.275367663.00000000053DA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	INV00987890.exe, 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comnte	INV00987890.exe, 00000000.00000003.265029682.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.264949600.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.coma	INV00987890.exe, 00000000.00000002.308767318.00000000053D0000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.298547621.00000000053D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comd	INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comeM	INV00987890.exe, 00000000.00000003.273991474.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.274943515.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.maviksel.com	INV00987890.exe, 00000004.00000002.531118006.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	INV00987890.exe, 00000000.00000003.267836467.00000000053D4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp, INV00987890.exe, 00000000.00000003.267409325.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.html	INV00987890.exe, 00000000.00000003.275437800.0000000005405000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://BJANwyE880kOV.net853321935-2125563209-4053062332-1002_Classes	INV00987890.exe, 00000004.00000003.317448459.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers8	INV00987890.exe, 00000000.00000002.309175319.0000000006662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comalic	INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.dem	INV00987890.exe, 00000000.00000003.276313639.00000000053D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cns-m	INV00987890.exe, 00000000.00000003.267409325.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.215.253.210	maviksel.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	635170
Start date and time: 27/05/202216:20:10	2022-05-27 16:20:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	INV00987890.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@3/6@3/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.1% (good quality ratio 0.1%) Quality average: 60.8% Quality standard deviation: 30.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 34 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.50.97.168, 93.184.221.240, 173.222.108.210, 173.222.108.226
Excluded domains from analysis (whitelisted): fs.microsoft.com, e8652.dscx.akamaiedge.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, arc.msn.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:21:31	API Interceptor	693x Sleep call for process: INV00987890.exe modified

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Users\user\Desktop\INV00987890.exe
File Type:	data
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\INV00987890.exe
File Type:	Microsoft Cabinet archive data, 61476 bytes, 1 file
Category:	dropped
Size (bytes):	61476
Entropy (8bit):	7.995018321729444
Encrypted:	true
SSDEEP:	1536:NATLwfiuePkACih0/8uIwf5CiqGLhk1V/AFnGegJR:N7nePk5gKsoBha/0GTf
MD5:	308336E7F515478969B24C13DED11EDE
SHA1:	8FB0CF42B77DBBEF224A1E5FC38ABC2486320775
SHA-256:	889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9
SHA-512:	61AD97228CD6C3909EF3AC5E4940199971F293BDD0D5EB7916E60469573A44B6287C0FA1E0B6C1389DF35EB6C9A7D2A61FDB318D4A886A3821EF5A9DAB3AC24F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....$.......,...................I........w.........Tp. .authroot.stl.H#F..4..CK..<Tk...c_.d....A.F...,.&K..i.RJJ..J.".%.KY"{n...."{..Lu3.Ln........y...........M.:...<. v...H..~.#Ov.a0xN....)..C..t.z.,x.00.1``L......L.\..1.\|..2.1.0mD...H1/......G..UT7!...r.X:....D.0.0...M....I(.-.+..v#...(.r.....z.Y`&hw..Gl+.je.e.j..{.1......9f=.&.........s.W...L.].+...).f...u.....8....}R...w.X..>.A.Yw...a.x...T8V.e...^.7.q..t^.+....f.q).B.M......64.<!W(........D!.0.t "X...l.....D0.......+...A......0.o..t93.v..O1V x}H.S)....GH.6.l...p2.(4k.....!,.L`......h:.a]?......J9.\..Ww........%......a4E...q....#..a..y..M..R.t..Z2!.T.Ua.k.'O..\./ d.F>.V...3...._.J....."....wI..'..z...j..Ds...qZ...[..........O<.d.K..hH@c1....[w7..z...l....h,.b.........'.w.......bO.i{.......+.-...H..."<...L.Tu}.Y.lB.]3..4..G.3..`E..NF......{o.h]}p....G..$..4....;..&.O.d....v:Ik.T..ObLq..&.j.j...B9.(..!..\.:K`.....:O..N.....C..jD:.i.......1.....eCo.c..3o.........nN.D..3.7...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Users\user\Desktop\INV00987890.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.759454828358771
Encrypted:	false
SSDEEP:	3:kkFklFgPvfllXlE/zMcjxrXNNX8RolJuRdyo1dlUKlGXJlDdt:kKjPk1NpNMa8Rdy+UKcXP
MD5:	1E734632A3B797F921CA36FCBA267555
SHA1:	FB8E9CB639A6BD642026CB80134C8954087CD7B7
SHA-256:	94D9398F502DE05859F4976BC6DFE4CB72FF4D3E80B898C3A8404B3DA3F63965
SHA-512:	DE4945AF965CDACAF1C5C82D56ED577CDFF533364D4E5247F66813878AC3729EE2DC39DFC01C9121218446EB3A46011F22AD0F78B1B12B54546AA0A70093446B
Malicious:	false
Reputation:	low
Preview:	p...... ........v.h.%r..(....................................................... ..........~....T..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".5.a.6.2.8.1.5.c.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\INV00987890.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.0985636032074564
Encrypted:	false
SSDEEP:	6:kKnmN+SkQlPlEGYRMY9z+4KlDA3RUecl7PG1:9kPlE99SNxAhUecl61
MD5:	C02354F3A48768C5598D49EEFEA51317
SHA1:	F03F057C0EC871499B069FC065FB34B0974B3F47
SHA-256:	14E0058B73254FC3210F10EB51D5558E82481428D694CB368361CBCCEF22C8F9
SHA-512:	FA8A54F6F4F8431B1778FEFB0A2CB8AFC88B88EB12054C87E28384A2B1AA45E0C7FA4B8766FFF15C084B5688CB4C2BD58CD8CFA82FAEEF764668A74A4EFFF618
Malicious:	false
Reputation:	low
Preview:	p...... .........S.8&r..(....................................................... ........3f..o......&...........$...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.3.3.6.6.b.4.9.0.6.f.d.8.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INV00987890.exe.log

Download File

Process:	C:\Users\user\Desktop\INV00987890.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\Desktop\INV00987890.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.694294591169137
Encrypted:	false
SSDEEP:	24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTt8:vDZhyoZWM9rU5fFcP
MD5:	6EB47C1CF858E25486E42440074917F2
SHA1:	6A63F93A95E1AE831C393A97158C526A4FA0FAAE
SHA-256:	9B13A3EA948A1071A81787AAC1930B89E30DF22CE13F8FF751F31B5D83E79FFB
SHA-512:	08437AB32E7E905EB11335E670CDD5D999803390710ED39CBC31A2D3F05868D5D0E5D051CCD7B06A85BB466932F99A220463D27FAC29116D241E8ADAC495FA2F
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....127.0.0.1

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.457754043877134
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	INV00987890.exe
File size:	518144
MD5:	fe5cab253ef5708d03dd6970e105b6c6
SHA1:	d7d0ba487169c56e33e92064b482c2d56d5dba5e
SHA256:	80f5923e2037f3596f2bebec849a1a55221c37c714d14eca6bdd35e12351ec7d
SHA512:	d522c952a8f8b0b619b488fde6571182ed27628a66f9b309dfb204e13cf211be29800eb01493294937579a227fe5a928dbbd4228de6344e31c7c0f376a3565d8
SSDEEP:	12288:VYEEIBxW7R0OfmlLBhek6U02K+olrtM5Jj:VxEMxW7WUmxHBH0lrtM5l
TLSH:	90B4DF013BAC7A12E66BDB3550A1804453F2844FBA33E51E3EDF2CDF16A6B149760B79
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'..b..............P.............&.... ........@.. .......................@............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x47fd26
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6290BC27 [Fri May 27 11:55:19 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7fcd4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0x5c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x82000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7dd2c	0x7de00	False	0.779971837761	data	7.4693135193	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x80000	0x5c0	0x600	False	0.427734375	data	4.12439241181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x82000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x80090	0x330	data
RT_MANIFEST	0x803d0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright HP Inc. 2019
Assembly Version	1.0.4.0
InternalName	TNVeK.exe
FileVersion	1.0.4.0
CompanyName	HP Inc.
LegalTrademarks
Comments
ProductName	Final Setup
ProductVersion	1.0.4.0
FileDescription	Final Setup
OriginalFilename	TNVeK.exe

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 16:21:53.984049082 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:21:54.153772116 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:21:54.153924942 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:21:55.639431953 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:21:55.639763117 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:21:55.807671070 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:21:55.807991028 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:21:55.977329969 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:21:56.085055113 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:21:56.274815083 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:21:56.274930000 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:21:56.274964094 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:21:56.278034925 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:21:56.304992914 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:21:56.473186970 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:21:56.603131056 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:00.993542910 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:01.161530018 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:01.163355112 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:01.331542015 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:01.336613894 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:01.544559956 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:01.627439976 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:01.628704071 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:01.796606064 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:01.805218935 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:02.006067038 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:02.006397963 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:02.175856113 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:02.177301884 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:02.177412033 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:02.178045988 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:02.178121090 CEST	49753	587	192.168.2.3	162.215.253.210
May 27, 2022 16:22:02.345071077 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:02.345103025 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:02.345554113 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:02.345643044 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:02.346275091 CEST	587	49753	162.215.253.210	192.168.2.3
May 27, 2022 16:22:02.400403976 CEST	49753	587	192.168.2.3	162.215.253.210

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 16:21:53.303886890 CEST	65358	53	192.168.2.3	8.8.8.8
May 27, 2022 16:21:53.604362011 CEST	53	65358	8.8.8.8	192.168.2.3
May 27, 2022 16:21:53.684684038 CEST	53802	53	192.168.2.3	8.8.8.8
May 27, 2022 16:21:53.965389967 CEST	53	53802	8.8.8.8	192.168.2.3
May 27, 2022 16:21:57.851927996 CEST	65266	53	192.168.2.3	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 27, 2022 16:21:53.303886890 CEST	192.168.2.3	8.8.8.8	0x6cd5	Standard query (0)	mail.maviksel.com	A (IP address)	IN (0x0001)
May 27, 2022 16:21:53.684684038 CEST	192.168.2.3	8.8.8.8	0xb842	Standard query (0)	mail.maviksel.com	A (IP address)	IN (0x0001)
May 27, 2022 16:21:57.851927996 CEST	192.168.2.3	8.8.8.8	0x5f8f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 27, 2022 16:21:53.604362011 CEST	8.8.8.8	192.168.2.3	0x6cd5	No error (0)	mail.maviksel.com	maviksel.com		CNAME (Canonical name)	IN (0x0001)
May 27, 2022 16:21:53.604362011 CEST	8.8.8.8	192.168.2.3	0x6cd5	No error (0)	maviksel.com		162.215.253.210	A (IP address)	IN (0x0001)
May 27, 2022 16:21:53.965389967 CEST	8.8.8.8	192.168.2.3	0xb842	No error (0)	mail.maviksel.com	maviksel.com		CNAME (Canonical name)	IN (0x0001)
May 27, 2022 16:21:53.965389967 CEST	8.8.8.8	192.168.2.3	0xb842	No error (0)	maviksel.com		162.215.253.210	A (IP address)	IN (0x0001)
May 27, 2022 16:21:57.876038074 CEST	8.8.8.8	192.168.2.3	0x5f8f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 27, 2022 16:21:55.639431953 CEST	587	49753	162.215.253.210	192.168.2.3	220-bh-73.webhostbox.net ESMTP Exim 4.94.2 #2 Fri, 27 May 2022 14:21:55 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2022 16:21:55.639763117 CEST	49753	587	192.168.2.3	162.215.253.210	EHLO 141700
May 27, 2022 16:21:55.807671070 CEST	587	49753	162.215.253.210	192.168.2.3	250-bh-73.webhostbox.net Hello 141700 [102.129.143.42] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2022 16:21:55.807991028 CEST	49753	587	192.168.2.3	162.215.253.210	STARTTLS
May 27, 2022 16:21:55.977329969 CEST	587	49753	162.215.253.210	192.168.2.3	220 TLS go ahead

Statistics

High Level Behavior Distribution

Click to dive into process behavior distribution

Disassembly

Reset < >

Analysis Process: INV00987890.exePID: 6468, Parent PID: 6136COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	128
Total number of Limit Nodes:	7

Executed Functions

Function 04440346 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.307291192.0000000004440000.00000040.00000800.00020000.00000000.sdmp, Offset: 04440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4440000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bcc5458236c6dc327ac9819afd5e55e679fb6121da88ee9170a52dfa57bcab1
Instruction ID: 7a895a46513e1edf156b262d3c458104a1d645a05930b2ff60f718358b360465
Opcode Fuzzy Hash: 7bcc5458236c6dc327ac9819afd5e55e679fb6121da88ee9170a52dfa57bcab1
Instruction Fuzzy Hash: 10814C70E1A208DFDF64CFA5D58459DFBB2FB89310F20A52AD50AFB254E734A8528F14

Uniqueness

Uniqueness Score: -1.00%

Function 04442238 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.307291192.0000000004440000.00000040.00000800.00020000.00000000.sdmp, Offset: 04440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4440000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b27b52a6ac3abe04f8ddfa3af8f68715ea230d590c0f3286b974d713b3a4dd
Instruction ID: d260f755f92aa45bb456272e65572641d23279b5b5e284c4587a907768640ee0
Opcode Fuzzy Hash: c2b27b52a6ac3abe04f8ddfa3af8f68715ea230d590c0f3286b974d713b3a4dd
Instruction Fuzzy Hash: 5731C331909244CFEF05CF65C448AEDBFF0BF4A350F1480AAE011B7261D7789A44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 023294C8 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0232970E

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 20e4c4c51d89c0e946af2416d7e2414d54bc0fccb0bbda7993117b3882bee431
Instruction ID: e76f92a6b42e7ac472b8bf7e842309d4a50844cb07266ec77a24b19d06cc80dc
Opcode Fuzzy Hash: 20e4c4c51d89c0e946af2416d7e2414d54bc0fccb0bbda7993117b3882bee431
Instruction Fuzzy Hash: 91712370A00B158FDB24DF69D54079ABBF5BF88314F10892DE58ADBA40D734E94ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 0232DAFC Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0232FDEA

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6757b32b88d42d71d36b3eb84ab6e9cf03b6ae1261b43f4411cdbd453f69abaf
Instruction ID: 5018fc88ff3a40ff45aa0e0bb263829e11dd4a6386b73ce9221ae66e0968a6d5
Opcode Fuzzy Hash: 6757b32b88d42d71d36b3eb84ab6e9cf03b6ae1261b43f4411cdbd453f69abaf
Instruction Fuzzy Hash: FF51BEB1D00318DFDB15CF9AC984ADEBBB5FF48314F24812AE819AB210D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0232FCCC Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0232FDEA

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 507cae2becc4f2e1a4f7a3da1a87f8260097f671725b59936ac57bab7cf95cc3
Instruction ID: 66a34645c775510e0e1b094f635f51763091ceadec89d6430fb72ff8ccf6febb
Opcode Fuzzy Hash: 507cae2becc4f2e1a4f7a3da1a87f8260097f671725b59936ac57bab7cf95cc3
Instruction Fuzzy Hash: 8E51BEB1D00319DFDB15CFAAC984ADEBBB5FF48314F24812AE819AB214D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0232B9A4 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0232BDA6,?,?,?,?,?), ref: 0232BE67

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c95027798766b082031553611f4d7c34cfb439d2890ee3b01b5150806209f9dc
Instruction ID: df547ebca9fe6988eb5d1da8fae84978b680db010293c2e0772f74c8952503e3
Opcode Fuzzy Hash: c95027798766b082031553611f4d7c34cfb439d2890ee3b01b5150806209f9dc
Instruction Fuzzy Hash: C52103B5900208DFDB10CFAAD984BEEFBF9EB48324F14841AE914A3310C374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0232BDD9 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0232BDA6,?,?,?,?,?), ref: 0232BE67

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 58db1ef13deea7c648d3f8928e4cdbd3e4f4a232efdb36b058b92c569afff5f8
Instruction ID: 793f64c8f51b9d559a8c8464ed36eea7f222b50bd45ba115e8e7667ea52ddce0
Opcode Fuzzy Hash: 58db1ef13deea7c648d3f8928e4cdbd3e4f4a232efdb36b058b92c569afff5f8
Instruction Fuzzy Hash: B02100B59002089FDB10CFAAD984ADEFFF4EB48324F14841AE958A3310C374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02329928 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02329789,00000800,00000000,00000000), ref: 0232999A

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 820ec42972b795c5efd2dbab0b7d2708663fdaa94f87569cbe5db86037fab453
Instruction ID: 652a99257ca82ea257fe4ae35cc56af96786d031bce01133db0e6fa3ff87e873
Opcode Fuzzy Hash: 820ec42972b795c5efd2dbab0b7d2708663fdaa94f87569cbe5db86037fab453
Instruction Fuzzy Hash: 791114B69002088FCB10CF9AD944BDEFBF4AB88324F15842ED559B7600C374A54ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02328870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02329789,00000800,00000000,00000000), ref: 0232999A

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dda298f8d35f400cd1ac423dcbd53aa7240aed85e162bf529df50b33b70c7665
Instruction ID: a010b8c2258060f6d4a7839a36988bbedb1bcc61dc0f796db39fc72cbcb0d103
Opcode Fuzzy Hash: dda298f8d35f400cd1ac423dcbd53aa7240aed85e162bf529df50b33b70c7665
Instruction Fuzzy Hash: 501106B69042189FDB10CF9AC444BDEFBF4AB48324F11842EE555B7200C374A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 023296A8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0232970E

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 99c46fe02e46a29c88e1b57a734e98eece9499c80d07897d9568ba85276e1844
Instruction ID: 8fd36e76a6dbcfe232aa5849debd4da4075eeae41b2f2a07c03702e73ad50cc7
Opcode Fuzzy Hash: 99c46fe02e46a29c88e1b57a734e98eece9499c80d07897d9568ba85276e1844
Instruction Fuzzy Hash: 9B11E0B5D006598FCB20CF9AC444BDEFBF4EB88324F15846AD869A7600C374A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0232DB34 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0232FF08,?,?,?,?), ref: 0232FF7D

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: e0ba7663ea6b0ab22609449fb0ea9a1483db064ad0132f532f5ee2cba5a3e068
Instruction ID: 9617e894f9d346c2e4b3991ea1f0724e2a6001156f27324f7d65f7027b1bc467
Opcode Fuzzy Hash: e0ba7663ea6b0ab22609449fb0ea9a1483db064ad0132f532f5ee2cba5a3e068
Instruction Fuzzy Hash: 8D11F2B59043189FDB20DF99D588BDEBBF8EB48324F10845AE959A7700C374A948CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0232FF18 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0232FF08,?,?,?,?), ref: 0232FF7D

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: cd35ac4592ab7dd142ff7a36cb1948a2ef9d642bcdd9749bea63373ce0a7d76d
Instruction ID: 63a2b7fd17e99f21cb6fffe7094085868a5b2d46f3e0c5cc65d2a73ca68c6547
Opcode Fuzzy Hash: cd35ac4592ab7dd142ff7a36cb1948a2ef9d642bcdd9749bea63373ce0a7d76d
Instruction Fuzzy Hash: 771122B5900309CFDB10DF99D589BDEFBF4EB48324F10845AE918A7600C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0444094B Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 044409AD

Memory Dump Source

Source File: 00000000.00000002.307291192.0000000004440000.00000040.00000800.00020000.00000000.sdmp, Offset: 04440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4440000_INV00987890.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 883b5f1dadd02504813c1aef9c79077c36c8581d9cb14d6f218d8ab98c579f31
Instruction ID: 3a871f87045f1f1828e719447040257a6f28698af5a4064d77d2c2e5303a1419
Opcode Fuzzy Hash: 883b5f1dadd02504813c1aef9c79077c36c8581d9cb14d6f218d8ab98c579f31
Instruction Fuzzy Hash: D111D6B58043499FDB20DF99D885BDFBBF8EB88324F14841AE654A7300C374A555CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04440950 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 044409AD

Memory Dump Source

Source File: 00000000.00000002.307291192.0000000004440000.00000040.00000800.00020000.00000000.sdmp, Offset: 04440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4440000_INV00987890.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5b66357b0d7dcb863ce7df3510feca1ccada8680904ee2cfc31a4c554b6d2cf2
Instruction ID: 6352e0f55f1fb56c48c0cd90368b22f96df68cc078e76c8b69e07f210fd31837
Opcode Fuzzy Hash: 5b66357b0d7dcb863ce7df3510feca1ccada8680904ee2cfc31a4c554b6d2cf2
Instruction Fuzzy Hash: BD11D3B58043499FDB20DF99D885BDFBBF8EB88324F10841AE554A7200C374A594CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04440040 Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 0444009F

Memory Dump Source

Source File: 00000000.00000002.307291192.0000000004440000.00000040.00000800.00020000.00000000.sdmp, Offset: 04440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4440000_INV00987890.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d4728216cdfe678f0b32fc02c6ecb7c6d82edbaf92898b10f462ab90cfeaeabe
Instruction ID: 83a1a2994f8d63627000640be0eacef2f2030bd18446431f7cbe40c31dd231a6
Opcode Fuzzy Hash: d4728216cdfe678f0b32fc02c6ecb7c6d82edbaf92898b10f462ab90cfeaeabe
Instruction Fuzzy Hash: E61115B18042098FDB20DF9AD448BDEFBF4EB88324F10845AD558A7300C374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0444003B Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 0444009F

Memory Dump Source

Source File: 00000000.00000002.307291192.0000000004440000.00000040.00000800.00020000.00000000.sdmp, Offset: 04440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4440000_INV00987890.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0e9d13bf482abd9a12c93ba01b3cc4eb6da5a6fa20d88e1fe6ee21248a30256c
Instruction ID: 4bbbfcefcb7ab531f39387f5d2abe309a9b1899216467a6b29bf6394172e896f
Opcode Fuzzy Hash: 0e9d13bf482abd9a12c93ba01b3cc4eb6da5a6fa20d88e1fe6ee21248a30256c
Instruction Fuzzy Hash: C61112B5800209CFDB20DF99D988BDEBBF4EB88328F14845AD568A7300D374A585CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0016A11D Relevance: .6, Instructions: 587
COMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E0016A11D(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, intOrPtr* __esi, void* __fp0) {
				signed char _t393;
				intOrPtr* _t394;
				signed int* _t395;
				signed int _t396;
				signed int _t397;
				signed char _t398;
				intOrPtr* _t400;
				intOrPtr* _t401;
				signed char _t402;
				signed int _t403;
				intOrPtr* _t404;
				signed char _t405;
				signed char _t406;
				signed int _t407;
				signed int _t408;
				signed int _t410;
				intOrPtr* _t412;
				signed char _t413;
				intOrPtr* _t414;
				signed char _t415;
				signed char _t416;
				signed char _t418;
				signed int _t420;
				signed int _t421;
				signed char _t422;
				signed char _t424;
				signed char _t425;
				signed char _t426;
				intOrPtr* _t427;
				signed char _t429;
				signed int _t430;
				signed char _t433;
				signed char _t434;
				signed char _t436;
				signed int _t437;
				signed char _t439;
				signed char _t440;
				intOrPtr* _t445;
				signed int _t446;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t451;
				signed int _t452;
				signed int _t453;
				intOrPtr* _t455;
				signed char _t456;
				intOrPtr* _t457;
				signed char _t458;
				signed int _t459;
				signed char _t461;
				signed int _t463;
				signed char _t464;
				signed int _t465;
				signed char _t468;
				signed int _t469;
				signed char _t471;
				intOrPtr* _t472;
				intOrPtr* _t474;
				signed char _t475;
				signed char _t476;
				intOrPtr* _t477;
				signed char _t478;
				signed char _t479;
				signed int _t480;
				intOrPtr* _t482;
				intOrPtr* _t484;
				intOrPtr* _t485;
				void* _t486;
				signed char _t487;
				signed char _t488;
				signed int _t490;
				signed char _t492;
				signed int _t493;
				signed char _t496;
				signed int _t497;
				signed char _t499;
				signed int _t500;
				signed int _t501;
				signed int _t502;
				signed int _t503;
				signed char _t504;
				signed char _t505;
				signed char _t506;
				intOrPtr* _t508;
				signed char _t509;
				signed char _t510;
				intOrPtr* _t511;
				signed char _t512;
				signed int _t513;
				signed int _t514;
				intOrPtr* _t515;
				signed int _t516;
				signed char _t517;
				signed char _t518;
				signed int _t519;
				signed char _t520;
				intOrPtr* _t523;
				signed int _t525;
				signed char _t529;
				signed int _t531;
				signed int _t533;
				void* _t534;
				void* _t536;
				void* _t538;
				void* _t540;
				void* _t545;
				signed int _t547;
				void* _t553;
				void* _t554;
				void* _t559;
				signed int _t562;
				signed char _t564;
				signed char _t565;
				void* _t566;
				signed int _t576;
				void* _t577;
				void* _t580;
				void* _t587;
				void* _t592;
				signed int _t595;
				void* _t597;
				void* _t599;
				void* _t601;
				signed int _t602;
				void* _t604;
				signed int _t607;
				void* _t610;
				void* _t614;
				signed int _t617;
				void* _t619;
				void* _t624;
				void* _t627;
				void* _t628;
				void* _t629;
				void* _t631;
				signed int _t632;
				void* _t634;
				void* _t635;
				signed int* _t636;
				void* _t639;
				void* _t640;
				void* _t642;
				signed int _t643;
				signed int* _t647;
				signed int* _t649;
				signed int* _t653;
				signed int* _t655;
				signed int* _t656;
				signed int _t662;
				signed int _t663;
				signed int* _t664;
				signed int _t667;
				signed char _t668;
				signed char _t669;
				signed int* _t671;
				signed int _t672;
				signed int _t673;
				signed int _t674;
				signed char _t676;
				signed int _t678;
				signed int _t682;
				void* _t684;
				signed int _t685;
				signed int _t687;
				signed int _t688;
				signed int _t690;
				signed int _t691;
				signed int _t692;
				signed int _t693;
				signed char _t694;
				signed char _t695;
				signed int _t697;
				signed int _t698;
				signed char _t701;
				signed int* _t703;
				void* _t704;
				signed int _t707;
				signed int _t710;
				void* _t711;
				signed char _t716;
				signed int _t717;
				signed int _t718;
				signed int _t719;
				signed int _t720;
				signed int _t722;
				signed int _t723;
				signed int _t726;
				signed int _t728;
				signed int _t729;
				signed int _t731;
				signed int _t732;
				signed int _t733;
				signed int _t734;
				signed int _t736;
				signed int _t737;
				signed int _t738;
				signed int _t742;
				signed int _t743;
				signed int _t744;
				signed char _t745;
				signed int _t747;
				signed int _t749;
				signed int _t750;
				signed int _t751;
				signed int _t754;
				signed int _t755;
				signed int _t758;
				signed int _t760;
				signed int _t762;
				signed int _t764;
				intOrPtr* _t767;
				signed int _t768;
				signed int _t769;
				signed int _t771;
				signed int _t772;
				signed int _t775;
				signed int _t776;
				void* _t778;
				signed int _t789;
				signed int _t791;
				void* _t792;
				signed int _t793;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t802;
				signed int _t803;
				signed int _t806;
				signed int _t807;
				signed int* _t809;
				void* _t811;
				signed int* _t812;
				signed int _t818;
				signed int _t819;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t829;
				void* _t831;
				signed int _t871;
				signed int _t873;
				signed int _t876;
				signed char _t881;
				void* _t884;
				signed int _t888;

				_t767 = __esi;
				_t742 = __edi;
				_t660 = __ecx;
				_t531 = __ebx;
				_t701 = __edx | __eax;
				asm("adc [ebp+0x5], eax");
				 *__eax =  *__eax + __eax;
				_t393 = __eax & 0x00000021;
				 *_t393 =  *_t393 + _t393;
				 *_t393 =  *_t393 + _t393;
				asm("adc ecx, [eax]");
				 *__ecx =  *__ecx + __ecx;
				 *_t393 =  *_t393 + _t393;
				 *__ebx =  *__ebx + _t701;
				 *__ecx =  *__ecx | _t701;
				_t394 = _t393 + 0x10550;
				 *__ecx =  *__ecx & 0x00000000;
				 *_t394 =  *_t394 + _t394;
				 *__ebx =  *__ebx + _t701;
				 *0x1055605 =  *0x1055605 | __ebx;
				 *__ecx =  *__ecx + __ecx;
				asm("adc ecx, [eax]");
				asm("sbb al, 0xc");
				_pop(_t802);
				_t395 = _t394 + 0x21be0002;
				 *_t395 = _t395 +  *_t395;
				 *_t395 = _t395 +  *_t395;
				asm("adc [eax], ebx");
				_t396 =  *__ecx;
				_t703 = _t395;
				 *_t703 =  *_t703 + _t396;
				_t397 = _t703 + _t396;
				 *_t397 =  *_t397 & _t397;
				 *_t397 =  *_t397 + _t397;
				 *__esi =  *__esi + _t397;
				asm("sbb [ecx+edx+0x20006], al");
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				_push(ss);
				 *(__esi + 0x2056316) =  *(__esi + 0x2056316) | __ecx;
				_t398 = _t703 + _t397;
				 *_t398 =  *_t398 & _t398;
				 *_t398 =  *_t398 + _t398;
				 *__ebx =  *__ebx + _t703;
				asm("adc esp, [ebx+0x5]");
				_t400 = (_t398 | __ecx) +  *(_t398 | __ecx);
				_t824 = _t823 |  *_t703;
				 *_t400 =  *_t400 + _t400;
				 *_t400 =  *_t400 + _t400;
				_push(es);
				asm("sbb [ecx+edx+0x20006], al");
				_t401 = _t400 - 0x22;
				 *_t401 =  *_t401 + _t401;
				 *_t401 =  *_t401 + _t401;
				asm("les eax, [edx]");
				_t402 = _t401 + 0x20015;
				if(_t402 >= 0) {
					 *_t402 =  *_t402 + _t402;
					 *_t402 =  *_t402 + _t402;
					 *_t402 =  *_t402 + _t402;
					asm("aam 0x16");
					_push(es);
					 *__ebx =  *__ebx + _t402;
					_t660 = __ecx + _t402;
					_t529 = _t402 &  *_t402;
					 *_t529 =  *_t529 + _t529;
					 *_t660 =  *_t660 + _t529;
					 *((intOrPtr*)(__edi + 0x3056802)) =  *((intOrPtr*)(__edi + 0x3056802)) + _t529;
					_t402 = _t529 + _t660 &  *(_t529 + _t660);
					 *_t402 =  *_t402 + _t402;
					 *__esi =  *__esi + _t402;
					asm("sbb [ecx+edx+0x50006], al");
				}
				_push(es);
				 *0x230800 =  *0x230800 + _t402;
				 *_t402 =  *_t402 + _t402;
				_t403 = _t402 + _t402;
				_t704 = _t703 +  *((intOrPtr*)(_t403 + 0x5001505));
				 *((intOrPtr*)(_t403 + 0x23)) =  *((intOrPtr*)(_t403 + 0x23)) + _t531;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				asm("aam 0x16");
				_push(es);
				 *_t767 =  *_t767 + _t403;
				 *((intOrPtr*)(_t660 + 0x2e)) =  *((intOrPtr*)(_t660 + 0x2e)) + _t403;
				_t13 = _t531 + 0xb;
				 *_t13 =  *((intOrPtr*)(_t531 + 0xb)) + _t403;
				_t404 = _t767;
				_t768 = _t403;
				_push(ss);
				if( *_t13 >= 0) {
					_push(es);
					 *((intOrPtr*)(_t768 + _t802 + 0x200000)) =  *((intOrPtr*)(_t768 + _t802 + 0x200000)) + _t660;
				}
				 *_t404 =  *_t404 + _t404;
				 *((intOrPtr*)(_t531 + 0xb)) =  *((intOrPtr*)(_t531 + 0xb)) + _t404;
				 *0x6057616 = _t404;
				 *[cs:eax] =  *[cs:eax] + _t404;
				 *_t404 =  *_t404 + _t404;
				_t533 = _t531 + _t660 + 1;
				_pop(es);
				_t405 = _t404 + _t533;
				 *[cs:eax] =  *[cs:eax] + _t405;
				 *_t405 =  *_t405 & _t405;
				_t534 = _t533 + 1;
				_t707 = (_t704 +  *((intOrPtr*)(_t404 + 5)) | _t768) +  *((intOrPtr*)(_t768 + 5));
				_pop(es);
				 *_t742 =  *_t742 + _t534;
				asm("das");
				 *_t405 =  *_t405 + _t405;
				 *_t405 =  *_t405 + _t405;
				_t743 = _t742 |  *_t707;
				asm("invalid");
				_t406 = _t405 + 0x2f490008;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 & _t406;
				_t536 = _t534 + 2;
				_t662 = _t660 | _t533 |  *(_t406 + 0xf);
				 *0x2f520008 =  *0x2f520008;
				 *_t406 =  *_t406 + _t406;
				_t25 = _t536 + 0xb;
				 *_t25 =  *((intOrPtr*)(_t536 + 0xb)) + _t406;
				asm("fisttp qword [ecx]");
				if( *_t25 < 0) {
					 *_t406 =  *_t406 | _t406;
					_pop(_t824);
					asm("das");
					 *_t406 =  *_t406 + _t406;
				}
				 *_t406 =  *_t406 + _t406;
				 *((intOrPtr*)(_t536 + 0xb)) =  *((intOrPtr*)(_t536 + 0xb)) + _t406;
				asm("out dx, al");
				 *(_t536 + 0x65000905) =  *(_t536 + 0x65000905) | _t406;
				asm("das");
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				 *((intOrPtr*)(_t743 + 0x2f)) =  *((intOrPtr*)(_t743 + 0x2f)) + _t662;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 & _t406;
				_t538 = _t536 + 2;
				_t803 = _t802 |  *(_t743 + 0xa05900b);
				 *((intOrPtr*)(_t406 + 0x2f)) =  *((intOrPtr*)(_t406 + 0x2f)) + _t538;
				 *_t406 =  *_t406 + _t406;
				 *_t406 =  *_t406 + _t406;
				_t769 = _t768 |  *(_t707 + 0xe);
				_t407 =  *0x2f82000b;
				 *_t407 =  *_t407 + _t407;
				 *_t407 =  *_t407 & _t407;
				_t540 = _t538 + 2;
				_t408 = _t407 |  *(_t803 + 0xb05900e);
				 *((intOrPtr*)(_t540 + 0x2f)) =  *((intOrPtr*)(_t540 + 0x2f)) + _t662;
				 *((intOrPtr*)(_t540 + 0xb)) =  *((intOrPtr*)(_t540 + 0xb)) + _t408;
				asm("cmc");
				_t410 = _t803;
				asm("das");
				 *_t410 =  *_t410 + _t410;
				 *_t410 =  *_t410 & _t410;
				_push(cs);
				_t412 = (_t410 |  *_t410) + 0x2f9e000c;
				 *_t412 =  *_t412 + _t412;
				 *_t412 =  *_t412 + _t412;
				_push(es);
				_t413 =  *0x2fa8000d;
				 *_t413 =  *_t413 + _t413;
				 *_t413 =  *_t413 & _t413;
				_push(es);
				_t414 = _t413 + 0x2fb1000d;
				 *_t414 =  *_t414 + _t414;
				 *_t414 =  *_t414 + _t414;
				_t415 =  *0x2fbb000e;
				 *_t415 =  *_t415 + _t415;
				 *_t415 =  *_t415 & _t415;
				_t545 = _t540 + 5;
				_t416 = _t415 + 0x2fc4000e;
				 *_t416 =  *_t416 + _t416;
				 *_t416 =  *_t416 + _t416;
				asm("das");
				 *_t416 =  *_t416 + _t416;
				 *_t416 =  *_t416 & _t416;
				_t547 = _t545 + 2;
				_t663 = _t662 | _t547;
				asm("adc eax, 0xf0590");
				asm("xlatb");
				asm("das");
				 *_t416 =  *_t416 + _t416;
				 *_t416 =  *_t416 + _t416;
				_t806 = _t408 | 0x000c058a |  *_t769 |  *(_t663 + 0x10058a04);
				_t664 = _t663 + _t416;
				asm("das");
				 *_t416 =  *_t416 + _t416;
				 *_t416 =  *_t416 & _t416;
				_t744 = _t743 | _t664[0x4016401];
				_t710 = (_t707 |  *(_t743 + 0x18)) + _t662 + _t664;
				asm("das");
				 *_t416 =  *_t416 + _t416;
				 *_t416 =  *_t416 + _t416;
				_t418 = _t416 + 0x2ff4009b;
				 *_t418 =  *_t418 + _t418;
				 *_t418 =  *_t418 & _t418;
				_t420 = _t418 + 0x2ffd00a1;
				 *_t420 =  *_t420 + _t420;
				 *_t420 =  *_t420 + _t420;
				_t553 = (_t547 + 4 | _t710) + 1;
				_t421 = _t420 |  *_t664;
				 *((intOrPtr*)(_t744 + 0x7001205)) =  *((intOrPtr*)(_t744 + 0x7001205)) + _t710;
				 *_t421 =  *_t421 ^ _t421;
				 *_t421 =  *_t421 + _t421;
				 *((intOrPtr*)(_t553 + 0xb)) =  *((intOrPtr*)(_t553 + 0xb)) + _t421;
				_t422 = _t421 | 0x12059d00;
				 *_t422 =  *_t422 + _t710;
				 *_t422 =  *_t422 ^ _t422;
				 *_t422 =  *_t422 + _t422;
				 *((intOrPtr*)(_t553 + 0xb)) =  *((intOrPtr*)(_t553 + 0xb)) + _t422;
				_t745 = _t422;
				_t424 = _t744 + 0x301a0013;
				 *_t424 =  *_t424 + _t424;
				 *_t424 =  *_t424 & _t424;
				_t554 = _t553 + 1;
				_t425 = _t424;
				 *((intOrPtr*)(_t806 + 0x23001305)) =  *((intOrPtr*)(_t806 + 0x23001305)) + _t554;
				 *_t425 =  *_t425 ^ _t425;
				 *_t425 =  *_t425 + _t425;
				 *((intOrPtr*)(_t554 + 0xb)) =  *((intOrPtr*)(_t554 + 0xb)) + _t425;
				asm("wait");
				 *((intOrPtr*)(_t745 + 0x2d001405)) =  *((intOrPtr*)(_t745 + 0x2d001405)) + _t710;
				 *_t425 =  *_t425 ^ _t425;
				 *_t425 =  *_t425 + _t425;
				 *((intOrPtr*)(_t554 + 0xb)) =  *((intOrPtr*)(_t554 + 0xb)) + _t425;
				asm("cmpsb");
				 *((intOrPtr*)(_t806 + 0x36001405)) =  *((intOrPtr*)(_t806 + 0x36001405)) + _t554;
				 *_t425 =  *_t425 ^ _t425;
				 *_t425 =  *_t425 + _t425;
				 *((intOrPtr*)(_t554 + 0xb)) =  *((intOrPtr*)(_t554 + 0xb)) + _t425;
				 *1 =  *1 + 0x150597;
				_t426 = _t425 + 1;
				 *_t426 =  *_t426 ^ _t426;
				 *_t426 =  *_t426 + _t426;
				 *((intOrPtr*)(_t554 + 0xb)) =  *((intOrPtr*)(_t554 + 0xb)) + _t426;
				 *1 = es;
				asm("popfd");
				_t427 = _t426 + 0x30490015;
				 *_t427 =  *_t427 + _t427;
				 *_t427 =  *_t427 + _t427;
				_t429 = _t745 + 0x30530016;
				 *_t429 =  *_t429 + _t429;
				 *_t429 =  *_t429 & _t429;
				_t771 = _t769 |  *(_t769 + 0xf058a15) |  *(_t710 + 1);
				asm("popfd");
				_t430 = _t429 + 0x305c0016;
				 *_t430 =  *_t430 + _t430;
				 *_t430 =  *_t430 + _t430;
				_t747 = _t430 |  *0x00000002;
				_t433 = _t427 + 0x30660017;
				 *_t433 =  *_t433 + _t433;
				 *_t433 =  *_t433 & _t433;
				_t667 = 0x00000001 |  *(1 + _t433 - 0x63);
				_t434 = _t433 + 0x306f0017;
				 *_t434 =  *_t434 + _t434;
				 *_t434 =  *_t434 + _t434;
				_t559 = _t554 + 5;
				_t829 = _t824 |  *(_t707 + 0xa058a0b) |  *_t662 |  *(_t545 + 0x18) |  *(_t745 + 1) |  *_t747;
				 *((intOrPtr*)(_t747 + 0x79001805)) =  *((intOrPtr*)(_t747 + 0x79001805)) + _t710;
				 *_t434 =  *_t434 ^ _t434;
				 *_t434 =  *_t434 + _t434;
				 *((intOrPtr*)(_t559 + 0xb)) =  *((intOrPtr*)(_t559 + 0xb)) + _t434;
				asm("popfd");
				_t436 = (_t434 ^  *_t667) + 0x30820018;
				 *_t436 =  *_t436 + _t436;
				 *_t436 =  *_t436 + _t436;
				_t668 = _t667 |  *0x19059701;
				 *((intOrPtr*)(_t436 + _t771 + 0x200000)) =  *((intOrPtr*)(_t436 + _t771 + 0x200000)) + _t668;
				_t562 = _t559 + 2 |  *_t436;
				 *((intOrPtr*)(_t806 - 0x6affe6fb)) =  *((intOrPtr*)(_t806 - 0x6affe6fb)) + _t562;
				 *_t436 =  *_t436 ^ _t436;
				 *_t436 =  *_t436 + _t436;
				 *((intOrPtr*)(_t562 + 0xb)) =  *((intOrPtr*)(_t562 + 0xb)) + _t436;
				asm("xlatb");
				 *((intOrPtr*)(_t747 - 0x60ffe5fb)) =  *((intOrPtr*)(_t747 - 0x60ffe5fb)) + _t710;
				 *_t436 =  *_t436 ^ _t436;
				 *_t436 =  *_t436 + _t436;
				 *((intOrPtr*)(_t562 + 0xb)) =  *((intOrPtr*)(_t562 + 0xb)) + _t436;
				asm("loop 0x2");
				asm("popfd");
				_t437 = _t436 + 0x30a8001a;
				 *_t437 =  *_t437 + _t437;
				 *_t437 =  *_t437 + _t437;
				_t772 = _t771 |  *_t710;
				_t439 = _t747 + 0x30b2001b;
				 *_t439 =  *_t439 + _t439;
				 *_t439 =  *_t439 & _t439;
				_t564 = 2 + _t562;
				_t749 = _t437 |  *_t806;
				asm("popfd");
				_t440 = _t439 + 0x30bb001b;
				 *_t440 =  *_t440 + _t440;
				 *_t440 =  *_t440 + _t440;
				 *_t440 =  *_t440 + _t440;
				if( *_t440 > 0) {
					_push(0xcc001c05);
				}
				asm("sbb al, 0x0");
				asm("int3");
				 *_t440 =  *_t440 ^ _t440;
				 *_t440 =  *_t440 + _t440;
				 *_t668 =  *_t668 + _t440;
				 *((intOrPtr*)(_t440 + 0x1e000613)) =  *((intOrPtr*)(_t440 + 0x1e000613)) + _t668;
				 *((intOrPtr*)(_t440 + 0x32)) =  *((intOrPtr*)(_t440 + 0x32)) + _t710;
				 *_t440 =  *_t440 + _t440;
				 *_t440 =  *_t440 + _t440;
				 *_t440 =  *_t440 + _t440;
				_push(es);
				 *_t772 =  *_t772 + _t564;
				 *((intOrPtr*)(_t829 + _t772)) =  *((intOrPtr*)(_t829 + _t772)) + _t710;
				 *0x14 =  *0x14 + 0x14;
				 *0x14 =  *0x14 + 0x14;
				 *0x14 =  *0x14 + 0x14;
				asm("popad");
				_t807 = _t806 |  *0x00000019;
				_push(ds);
				 *0x14 =  *0x14 + 0x14;
				 *0x00000014 =  *0x00000014 + 0x14;
				 *_t668 =  *_t668 + 0x14;
				_t711 = _t710 + _t668;
				_t669 = _t668 |  *0x00000019;
				 *0x00000014 =  *0x00000014 & 0x00000014;
				 *_t772 =  *_t772 + 0x14;
				 *0x2201413B =  *((intOrPtr*)(0x2201413b)) + 0x36;
				 *0x0000006D =  *((intOrPtr*)(0x6d)) + _t711;
				 *_t772 =  *_t772 + 0x14;
				asm("sbb [ecx+edx+0x220006], al");
				 *0x37 =  *0x37 + _t711;
				 *((intOrPtr*)(_t669 + 0xc)) =  *((intOrPtr*)(_t669 + 0xc)) + _t711;
				 *0x36 =  *0x36 + _t829;
				_t445 = _t711 + 0x36;
				asm("aaa");
				 *_t445 =  *_t445 + 0x14;
				 *_t445 =  *_t445 + 0x14;
				asm("les eax, [edx]");
				_t446 = _t445 + 0x220015;
				 *_t446 =  *_t446 & _t564;
				 *_t446 =  *_t446 + 0x14;
				 *_t446 =  *_t446 + 0x14;
				 *_t446 =  *_t446 + _t446;
				asm("aam 0x16");
				_push(es);
				 *_t564 =  *_t564 + _t446;
				 *((intOrPtr*)(_t669 + _t446 * 2)) =  *((intOrPtr*)(_t669 + _t446 * 2)) + 0x36;
				 *_t446 =  *_t446 + 0x14;
				_t565 = _t564 |  *(_t564 + _t669 + 0x230141);
				 *_t669 = es;
				 *_t446 =  *_t446 + 0x14;
				_t671 = (_t669 | _t565) + 1;
				 *_t446 =  *_t446 + 0x14;
				 *_t446 =  *_t446 + 0x14;
				asm("adc [eax], eax");
				asm("sbb [eax], eax");
				asm("movsb");
				_t447 = _t446 + 0x41dc0024;
				 *_t447 =  *_t447 + 0x14;
				 *_t447 =  *_t447 + 0x14;
				asm("adc [eax], eax");
				_t448 = _t447 &  *_t671;
				asm("cmc");
				 *_t448 =  *_t448 + _t565;
				_t716 = (0x5e |  *0x98002300) + 1;
				 *_t448 =  *_t448 + 0x14;
				 *_t448 =  *_t448 + 0x14;
				_push(ss);
				 *(_t749 + 1) =  *(_t749 + 1) | _t716;
				asm("stosd");
				_t449 = _t448 + 0x424f0027;
				 *_t449 =  *_t449 + 0x14;
				 *_t449 =  *_t449 + 0x14;
				_push(ss);
				 *(_t749 + 1) =  *(_t749 + 1) | _t565;
				asm("cmc");
				_t831 = _t829 +  *0x37 +  *_t749;
				 *((intOrPtr*)(_t449 + 0x42)) =  *((intOrPtr*)(_t449 + 0x42)) + _t449;
				 *_t449 =  *_t449 + 0x14;
				 *_t449 =  *_t449 + 0x14;
				_push(ss);
				_t671[0xa016ac0] = _t671[0xa016ac0] + _t716;
				 *((intOrPtr*)(_t565 + _t449 * 2)) =  *((intOrPtr*)(_t565 + _t449 * 2)) + _t671;
				 *_t449 =  *_t449 + 0x14;
				 *_t449 =  *_t449 + 0x14;
				_push(ss);
				 *((intOrPtr*)(_t749 + 0x2805af01)) =  *((intOrPtr*)(_t749 + 0x2805af01)) + _t716;
				 *_t449 =  *_t449 + _t449;
				_t566 = _t565 + 1;
				 *_t449 =  *_t449 + 0x14;
				 *_t449 =  *_t449 + 0x14;
				_push(ss);
				 *((intOrPtr*)(_t807 + 1)) =  *((intOrPtr*)(_t807 + 1)) + _t566;
				_t450 = 5;
				 *5 =  *5 - 5;
				if( *5 >= 0) {
					 *5 =  *5 + 0x14;
					 *5 =  *5 + 0x14;
					asm("adc [eax], eax");
					_t450 = 5 + _t671;
					 *_t450 =  *_t450 + 0x14;
					 *_t450 =  *_t450 + 0x14;
					asm("adc [eax], eax");
					asm("movsb");
					 *((intOrPtr*)(_t671 - 0x5bffd500)) =  *((intOrPtr*)(_t671 - 0x5bffd500)) + _t716;
					 *_t450 =  *_t450 + 0x14;
					 *_t450 =  *_t450 + 0x14;
					_push(ss);
					 *_t671 = _t671 +  *_t671;
					 *((intOrPtr*)(_t671 - 0x40ffd400)) =  *((intOrPtr*)(_t671 - 0x40ffd400)) + 0x37;
					 *_t450 =  *_t450 + 0x14;
					 *_t450 =  *_t450 + 0x14;
					_t671 = _t671 + _t671;
					_t831 = (_t831 + 2 |  *(_t716 + 0x2d058a0b)) + 1;
					 *_t450 =  *_t450 + 0x14;
					 *_t450 =  *_t450 & 0x00000014;
					_t566 = _t566 + 3;
					_t807 = _t807 |  *(_t749 + 0x2d05900b);
				}
				_t717 = _t716 + _t716;
				 *_t450 = _t450 +  *_t450;
				 *_t450 = _t450 +  *_t450;
				_t451 =  *0x44dc002e;
				 *_t451 =  *_t451 + _t451;
				 *_t451 =  *_t451 & _t451;
				_t452 = _t451 |  *(_t807 + 0x2e05900e);
				_t672 = _t671 + _t452;
				 *_t452 =  *_t452 + _t452;
				 *_t452 =  *_t452 + _t452;
				_t775 = 0x00000037 |  *(_t717 + 0xe) | _t807;
				_t453 = _t452 | 0x002f058a;
				asm("out dx, eax");
				 *_t453 =  *_t453 + _t453;
				 *_t453 =  *_t453 & _t453;
				_push(cs);
				_t455 = (_t453 |  *_t453) + 0x44f8002f;
				 *_t455 =  *_t455 + _t455;
				 *_t455 =  *_t455 + _t455;
				_push(es);
				_t456 =  *0x45020030;
				 *_t456 =  *_t456 + _t456;
				 *_t456 =  *_t456 & _t456;
				_t457 = _t456 + 0x450b0030;
				 *_t457 =  *_t457 + _t457;
				 *_t457 =  *_t457 + _t457;
				_t718 = _t717 |  *(_t749 + 0x18);
				_t458 =  *0x45150031;
				 *_t458 =  *_t458 + _t458;
				 *_t458 =  *_t458 & _t458;
				_t459 = _t458 + 0x451e0031;
				 *_t459 =  *_t459 + _t459;
				 *_t459 =  *_t459 + _t459;
				_t776 = _t775 |  *(_t775 + 0x32058a15);
				 *_t459 =  *_t459 + _t672;
				_t809 = (_t807 |  *_t775) + 1;
				 *_t459 =  *_t459 + _t459;
				 *_t459 =  *_t459 & _t459;
				_t576 = _t566 + 0xa;
				_t673 = _t672 | _t576;
				asm("adc eax, 0x320590");
				 *_t809 =  *_t809 ^ _t459;
				 *_t459 =  *_t459 + _t459;
				 *((intOrPtr*)(_t576 + 0xb)) =  *((intOrPtr*)(_t576 + 0xb)) + _t459;
				 *_t576 =  *_t576 + _t576;
				_t810 =  &(_t809[0]);
				 *_t459 =  *_t459 + _t459;
				 *_t459 =  *_t459 & _t459;
				_t577 = _t576 + 1;
				_t750 = _t749 |  *(_t673 + 0x33059004);
				 *((intOrPtr*)(_t810 + _t459 * 2)) =  *((intOrPtr*)( &(_t809[0]) + _t459 * 2)) + _t459;
				 *_t459 =  *_t459 + _t459;
				 *((intOrPtr*)(_t577 + 0xb)) =  *((intOrPtr*)(_t577 + 0xb)) + _t459;
				_t811 = es;
				_t461 = _t459 + 0x454e00be;
				 *_t461 =  *_t461 + _t461;
				 *_t461 =  *_t461 & _t461;
				_t463 = _t461 + 0x455700c4;
				 *_t463 =  *_t463 + _t463;
				 *_t463 =  *_t463 + _t463;
				_t580 = (_t577 + 0x00000001 | _t718) + 1;
				_t719 = _t718 |  *(_t776 + 0x35057016);
				 *((intOrPtr*)(_t811 + _t463 * 2)) =  *((intOrPtr*)(_t811 + _t463 * 2)) + _t463;
				 *_t463 =  *_t463 + _t463;
				 *((intOrPtr*)(_t580 + 0xb)) =  *((intOrPtr*)(_t580 + 0xb)) + _t463;
				 *0x35057616 = _t463;
				 *((intOrPtr*)(_t750 + 0x45)) =  *((intOrPtr*)(_t750 + 0x45)) + _t463;
				 *((intOrPtr*)(_t580 + 0xb)) =  *((intOrPtr*)(_t580 + 0xb)) + _t463;
				asm("retf");
				_t720 = _t719 +  *((intOrPtr*)(_t463 + 5));
				 *[ss:ebp+eax*2+0x200000] =  *[ss:ebp+eax*2+0x200000] + _t720;
				_t722 = (_t720 | _t776) +  *((intOrPtr*)(_t776 + 5));
				_t812 = _t811 + 1;
				 *_t463 =  *_t463 + _t463;
				 *_t463 =  *_t463 + _t463;
				 *_t673 =  *_t673 + _t463;
				 *_t463 =  *_t463 + _t463;
				 *_t463 =  *_t463 & _t463;
				 *_t722 =  *_t722 + _t673;
				_t778 = 2 + _t776;
				 *_t463 =  *_t463 + _t463;
				 *_t463 =  *_t463 + _t463;
				_t464 = _t463 |  *(_t673 + 0x38059701);
				 *((intOrPtr*)(_t778 + _t464 * 2)) =  *((intOrPtr*)(_t778 + _t464 * 2)) + _t722;
				 *_t464 =  *_t464 + _t464;
				 *_t464 =  *_t464 & _t464;
				_t587 = (_t580 + 0x00000001 + _t722 + 0x00000001 |  *(_t580 + 1 + _t722 + 0x37059702)) + 3;
				_t674 = _t673 |  *(_t673 + _t464 + 0x38059d);
				asm("sbb eax, 0x46");
				 *((intOrPtr*)(_t587 + 0xb)) =  *((intOrPtr*)(_t587 + 0xb)) + _t464;
				 *((intOrPtr*)(_t587 + 0x3905)) =  *((intOrPtr*)(_t587 + 0x3905)) + _t722;
				 *_t750 =  *_t750 + _t464;
				 *_t464 =  *_t464 + _t464;
				 *_t464 =  *_t464 & _t464;
				asm("popfd");
				_t465 = _t464 + 0x46300039;
				 *_t465 =  *_t465 + _t465;
				 *_t465 =  *_t465 + _t465;
				_t751 = _t465 |  *(_t674 + 1);
				_t468 = _t750 + 0x463a003a;
				 *_t468 =  *_t468 + _t468;
				 *_t468 =  *_t468 & _t468;
				_t469 = _t468 + 0x4643003a;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *((intOrPtr*)(_t751 + 0x4d003b05)) =  *((intOrPtr*)(_t751 + 0x4d003b05)) + _t722;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 & _t469;
				_t592 = _t587 + 5;
				_t812[0x15800ec1] = _t812[0x15800ec1] + _t592;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				_t676 = _t674 |  *(_t674 + _t468 - 0x63) |  *0x3c059701;
				 *((intOrPtr*)(_t469 + 0x46)) =  *((intOrPtr*)(_t469 + 0x46)) + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 & _t469;
				_t595 = _t592 + 2 |  *_t469;
				_t812[0x1a400f01] = _t812[0x1a400f01] + _t595;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				_t723 = _t722 | _t751;
				 *((intOrPtr*)(_t751 + 0x73003d05)) =  *((intOrPtr*)(_t751 + 0x73003d05)) + _t723;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 & _t469;
				_t597 = 2 + _t595;
				_t812[0x1f000f41] = _t812[0x1f000f41] + _t597;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				_t471 = _t751 + 0x4686003e;
				 *_t471 =  *_t471 + _t471;
				 *_t471 =  *_t471 & _t471;
				_t599 = _t597 + 2;
				asm("popfd");
				_t472 = _t471 + 0x3414003e;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				asm("popad");
				asm("aas");
				 *((intOrPtr*)(_t472 + 0x46)) =  *((intOrPtr*)(_t472 + 0x46)) + _t723;
				 *_t676 =  *_t676 + _t472;
				_t678 = (_t676 |  *(_t472 + 5)) + 1;
				_t474 = _t472 + _t599 - 1;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				_push(es);
				 *((intOrPtr*)(_t474 + 0x43014105)) =  *((intOrPtr*)(_t474 + 0x43014105)) + _t474;
				 *((intOrPtr*)(_t678 + _t678 * 2)) =  *((intOrPtr*)(_t678 + _t678 * 2)) + _t678;
				_push(es);
				asm("sbb [ecx+edx+0x430006], al");
				asm("lodsb");
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				asm("les eax, [edx]");
				_t475 = _t474 + 0x430015;
				asm("cld");
				 *_t475 =  *_t475 + _t475;
				 *_t475 =  *_t475 + _t475;
				 *_t475 =  *_t475 + _t475;
				asm("aam 0x16");
				 *((intOrPtr*)(_t475 + _t475 - 0x3f)) =  *((intOrPtr*)(_t475 + _t475 - 0x3f)) + _t475;
				 *_t475 =  *_t475 + _t475;
				 *_t475 =  *_t475 + _t475;
				_t754 = _t469 |  *_t812 |  *(_t469 |  *_t812);
				asm("adc eax, 0x4405c0");
				asm("retf");
				_t789 = ((_t778 + 0x00000001 |  *(_t722 + 1)) + 0x00000001 |  *_t722) + 4 |  *_t723;
				 *_t475 =  *_t475 + _t475;
				 *_t475 =  *_t475 & _t475;
				_t601 = _t599 + 2;
				 *0x4ed40044 = 0;
				 *_t475 =  *_t475 + _t475;
				 *((intOrPtr*)(_t601 + 0xb)) =  *((intOrPtr*)(_t601 + 0xb)) + _t475;
				ss = es;
				asm("adc eax, 0x4505c0");
				asm("fimul word [esi]");
				 *_t475 =  *_t475 + _t475;
				 *((intOrPtr*)(_t601 + 0xb)) =  *((intOrPtr*)(_t601 + 0xb)) + _t475;
				asm("out 0x4e, eax");
				 *_t475 =  *_t475 + _t475;
				 *_t475 =  *_t475 + _t475;
				_t602 = _t601 + 1;
				_t682 = _t678 |  *(_t789 + 0x15) | _t602;
				_t726 = _t723 + _t676 -  *0x4505c6 +  *((intOrPtr*)(_t475 + 5));
				_t476 = _t475 + _t726;
				_t791 = _t789 + 1 - 1;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 & _t476;
				_t728 = (_t726 | _t791) +  *((intOrPtr*)(_t791 + 5));
				_t792 = _t791 + 1;
				 *_t754 =  *_t754 + _t728;
				_t755 = _t754 - 1;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				_t604 = 2 + _t602;
				_t729 = _t728 |  *(_t728 + 0x47057009);
				 *((intOrPtr*)(_t755 + _t682 * 2)) =  *((intOrPtr*)(_t755 + _t682 * 2)) + _t476;
				 *_t476 =  *_t476 + _t476;
				 *((intOrPtr*)(_t604 + 0xb)) =  *((intOrPtr*)(_t604 + 0xb)) + _t476;
				_t477 =  *0x47057609;
				 *((intOrPtr*)(_t755 + 0x4f)) =  *((intOrPtr*)(_t755 + 0x4f)) + _t477;
				_t227 = _t604 + 0xb;
				 *_t227 =  *((intOrPtr*)(_t604 + 0xb)) + _t477;
				asm("sbb ecx, [esi]");
				if( *_t227 < 0) {
					_t477 = _t477 - 1;
					 *((intOrPtr*)(_t755 + 0x200000 + _t682 * 2)) =  *((intOrPtr*)(_t755 + 0x200000 + _t682 * 2)) + _t729;
				}
				 *_t477 =  *_t477 + _t477;
				 *((intOrPtr*)(_t604 + 0xb)) =  *((intOrPtr*)(_t604 + 0xb)) + _t477;
				_t478 = _t477 - 0xe;
				 *0x4fd70048 =  *0x4fd70048;
				 *_t478 =  *_t478 + _t478;
				 *((intOrPtr*)(_t604 + 0xb)) =  *((intOrPtr*)(_t604 + 0xb)) + _t478;
				 *_t478 = _t478;
				asm("int 0x5");
				_t684 = _t682 - 1 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 & _t478;
				_t731 = (_t729 |  *(_t792 + 0x4905d300)) + _t684;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				_t685 = _t684 + _t684;
				_t479 = _t478 + 0x4ff4004a;
				 *_t479 =  *_t479 + _t479;
				 *_t479 =  *_t479 & _t479;
				_t607 = _t604 + 3;
				_t758 = _t755 | _t607;
				_t480 = _t479 + 0x4ffd004a;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				_t732 = _t731 |  *(_t792 + 0x4b057016);
				 *_t480 =  *_t480 + _t685;
				_push(_t480);
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 & _t480;
				_t610 = _t607 + _t731 + 2;
				 *((intOrPtr*)(_t610 + 0x50)) =  *((intOrPtr*)(_t610 + 0x50)) + _t685;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *((intOrPtr*)(_t480 + 0x50)) =  *((intOrPtr*)(_t480 + 0x50)) + _t610;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				_t793 = _t480;
				asm("adc al, 0x68");
				_t482 = _t792 + 0x521c004e;
				 *_t482 =  *_t482 + _t482;
				 *_t482 =  *_t482 + _t482;
				 *_t482 =  *_t482 + _t482;
				_t484 = _t482 + 0x50056815 + _t732;
				_push(_t610);
				 *_t484 =  *_t484 + _t484;
				 *_t484 =  *_t484 + _t484;
				 *_t484 =  *_t484 + _t484;
				 *_t484 =  *_t484 + _t732;
				_push(0x4c056802);
				 *_t484 =  *_t484 + _t484;
				 *_t484 =  *_t484 + _t484;
				 *_t484 =  *_t484 + _t484;
				asm("retf 0x680a");
				_t485 = _t484 + 0x34140054;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				asm("popad");
				 *((intOrPtr*)(_t485 + 0x56)) =  *((intOrPtr*)(_t485 + 0x56)) + _t685;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				_t486 = ss;
				 *((intOrPtr*)(_t486 + 0x56)) =  *((intOrPtr*)(_t486 + 0x56)) + _t685;
				 *_t685 =  *_t685 + _t486;
				 *_t685 =  *_t685 + _t486;
				_t818 = (0x4c056802 |  *(_t485 + 5)) +  *(_t485 + 5) |  *(_t486 + 5);
				_t733 = _t793;
				_t487 = _t486 + _t685;
				_push(_t758);
				 *_t487 =  *_t487 + _t487;
				 *_t487 =  *_t487 + _t487;
				asm("sbb [ecx+edx+0x5c0006], al");
				_t488 = _t487 | 0x00000058;
				 *_t488 =  *_t488 + _t488;
				 *_t488 =  *_t488 + _t488;
				asm("les eax, [edx]");
				_t490 = es;
				 *_t490 =  *_t490 + _t490;
				 *_t490 =  *_t490 + _t490;
				 *_t490 =  *_t490 + _t490;
				asm("aam 0x16");
				_push(es);
				 *0x4c056802 =  *0x4c056802 + _t610;
				 *0x4c056802 =  *0x4c056802 << 0;
				 *_t490 =  *_t490 + _t490;
				_t492 = _t758 + 0x65cb005d;
				 *_t492 =  *_t492 + _t492;
				 *_t492 =  *_t492 & _t492;
				_t760 = _t490 |  *0x4c056802;
				asm("popfd");
				_t493 = _t492 + 0x65d4005d;
				 *_t493 =  *_t493 + _t493;
				 *_t493 =  *_t493 + _t493;
				_t734 = _t733 | _t760;
				 *((intOrPtr*)(_t760 - 0x21ffa1fb)) =  *((intOrPtr*)(_t760 - 0x21ffa1fb)) + _t734;
				 *[gs:eax] =  *[gs:eax] + _t493;
				 *_t493 =  *_t493 & _t493;
				_t614 = _t610 + 4;
				 *0x3305C607 =  *((intOrPtr*)(0x3305c607)) + _t614;
				 *[gs:eax] =  *[gs:eax] + _t493;
				 *_t493 =  *_t493 + _t493;
				_t687 = (_t685 |  *0x5f059701) + _t734;
				 *[gs:eax] =  *[gs:eax] + _t493;
				 *_t493 =  *_t493 & _t493;
				_t617 = _t614 + 2 |  *_t493;
				 *0x4605C707 =  *((intOrPtr*)(0x4605c707)) + _t617;
				 *[gs:eax] =  *[gs:eax] + _t493;
				 *_t493 =  *_t493 + _t493;
				 *((intOrPtr*)(_t760 + 0x4006005)) =  *((intOrPtr*)(_t760 + 0x4006005)) + _t734;
				asm("o16 add [eax], al");
				 *_t493 =  *_t493 & _t493;
				_t619 = 2 + _t617;
				 *0x5905C807 =  *((intOrPtr*)(0x5905c807)) + _t619;
				asm("o16 add [eax], al");
				 *_t493 =  *_t493 + _t493;
				_t496 = _t760 + 0x66170061;
				 *_t496 =  *_t496 + _t496;
				 *_t496 =  *_t496 & _t496;
				_t688 = _t687 |  *(_t687 + _t496 - 0x63);
				_t497 = _t496 + 0x66200061;
				 *_t497 =  *_t497 + _t497;
				 *_t497 =  *_t497 + _t497;
				_t762 = _t497;
				_t499 = (_t493 |  *(_t687 + 1)) + 0x662a0062;
				 *_t499 =  *_t499 + _t499;
				 *_t499 =  *_t499 & _t499;
				asm("popfd");
				_t500 = _t499 + 0x66330062;
				 *_t500 =  *_t500 + _t500;
				 *_t500 =  *_t500 + _t500;
				_t624 = _t619 + 5;
				_t501 = _t500 |  *(_t688 + 0x63059701);
				 *0x20000066 =  *0x20000066 + _t624;
				 *((intOrPtr*)(_t624 + 0xb)) =  *((intOrPtr*)(_t624 + 0xb)) + _t501;
				 *_t688 = es;
				asm("popfd");
				_t502 = _t501 + 0x66460063;
				 *_t502 =  *_t502 + _t502;
				 *_t502 =  *_t502 + _t502;
				 *((intOrPtr*)(_t502 + 0x66)) =  *((intOrPtr*)(_t502 + 0x66)) + _t734;
				 *_t502 =  *_t502 + _t502;
				 *_t502 =  *_t502 & _t502;
				_t627 = (_t624 + 0x00000001 |  *(_t624 + 0x64059702)) + 1;
				 *((intOrPtr*)(_t688 + 0x66)) =  *((intOrPtr*)(_t688 + 0x66)) + _t627;
				 *_t502 =  *_t502 + _t502;
				 *_t502 =  *_t502 + _t502;
				_t628 = _t627 + 1;
				_t797 = _t793 |  *_t733 |  *_t734 |  *(_t734 + 1) |  *0xB10AFF03;
				 *((intOrPtr*)(_t628 + 0x66)) =  *((intOrPtr*)(_t628 + 0x66)) + _t502;
				 *_t502 =  *_t502 + _t502;
				 *_t502 =  *_t502 & _t502;
				_t629 = _t628 + 1;
				_t503 = _t502;
				 *0xB805CD07 =  *((intOrPtr*)(0xb805cd07)) + _t629;
				asm("o16 add [eax], al");
				 *_t503 =  *_t503 + _t503;
				_t504 = _t503 |  *_t688;
				 *((intOrPtr*)(_t762 + 0x76006605)) =  *((intOrPtr*)(_t762 + 0x76006605)) + _t734;
				asm("o16 add [eax], al");
				 *_t504 =  *_t504 & _t504;
				_t631 = _t629 + 2;
				 *((intOrPtr*)(_t762 + 0x66)) =  *((intOrPtr*)(_t762 + 0x66)) + _t631;
				 *_t504 =  *_t504 + _t504;
				 *_t504 =  *_t504 + _t504;
				_t632 = _t631 + 1;
				_t690 = _t688 |  *0x66059d00 | _t632;
				 *((intOrPtr*)(_t797 + 0x66)) =  *((intOrPtr*)(_t797 + 0x66)) + _t690;
				 *_t504 =  *_t504 + _t504;
				 *((intOrPtr*)(_t632 + 0xb)) =  *((intOrPtr*)(_t632 + 0xb)) + _t504;
				asm("salc");
				_t736 = _t734 +  *((intOrPtr*)(_t504 + 5)) +  *((intOrPtr*)(_t797 + 5));
				asm("o16 add [eax], al");
				 *_t504 =  *_t504 + _t504;
				_t634 = _t632 + _t690 + 1;
				_t505 = _t504 + _t634;
				asm("o16 add [eax], al");
				 *_t505 =  *_t505 & _t505;
				_t635 = _t634 + 1;
				_t691 = _t690 | 0x4c056802;
				_t506 = _t505 + 0x680576;
				_pop(ds);
				 *((intOrPtr*)(_t635 + _t797)) =  *((intOrPtr*)(_t635 + _t797)) + _t506;
				 *_t506 =  *_t506 + _t506;
				_t636 = _t635 + 1;
				_t764 = _t762 |  *(_t762 + 0x68057005) |  *_t636;
				_push(es);
				if(_t764 >= 0) {
					_t506 =  *_t506 * 0x672c;
				}
				 *_t506 =  *_t506 + _t506;
				_t636[2] = _t636[2] + _t506;
				_t692 = _t691 - 1;
				_push(es);
				if(_t692 > 0) {
					_t506 =  *_t506 * 0x676f;
				}
				 *_t506 =  *_t506 + _t506;
				_t301 =  &(_t636[2]);
				 *_t301 = _t636[2] + _t506;
				_t871 =  *_t301;
				asm("insd");
				_push(ss);
				if(_t871 < 0) {
					L20:
					 *_t506 =  *_t506 + _t506;
					_t303 =  &(_t636[2]);
					 *_t303 = _t636[2] + _t506;
					_t873 =  *_t303;
					if(_t873 == 0) {
						if(_t873 > 0) {
							_push(0);
							_t764 = 0x67;
						}
						 *_t506 =  *_t506 + _t506;
						_t636[2] = _t636[2] + _t506;
						_pop(_t818);
						_t506 = _t506 + 0x67c900f5;
						 *_t506 =  *_t506 + _t506;
					}
					 *_t506 =  *_t506 & _t506;
					_t508 = _t506 + 0x67d200fb;
					 *_t508 =  *_t508 + _t508;
					 *_t508 =  *_t508 + _t508;
					_t639 = ( &(_t636[0]) | _t736) + 1;
					_t818 = _t818 |  *(_t692 + 0x6c058a04);
					_t509 = _t508 + _t639;
					 *((intOrPtr*)(_t639 + _t797)) =  *((intOrPtr*)(_t639 + _t797)) + _t509;
					 *_t509 =  *_t509 & _t509;
					_t640 = _t639 + 1;
					_t764 = _t764 |  *(_t692 + 0x6c059004);
					_t693 = _t692 + _t509;
					 *((intOrPtr*)(_t640 + _t797)) =  *((intOrPtr*)(_t640 + _t797)) + _t509;
					 *_t509 =  *_t509 + _t509;
					_t797 = _t797 |  *(_t797 + 0x6d058a15);
					_t642 = _t640 + 1 + _t693;
					 *((intOrPtr*)(_t642 + _t797)) =  *((intOrPtr*)(_t642 + _t797)) + _t509;
					 *_t509 =  *_t509 & _t509;
					_t643 = _t642 + 1;
					_t692 = _t693 | _t643;
					asm("adc eax, 0x6d0590");
					asm("clc");
					 *((intOrPtr*)(_t643 + _t797)) =  *((intOrPtr*)(_t643 + _t797)) + _t509;
					 *_t509 =  *_t509 + _t509;
					_t636 = _t643 + 1;
				} else {
					_push(0);
					if(_t871 >= 0) {
						 *_t506 =  *_t506 + _t506;
						goto L20;
					}
				}
				_t737 = _t736 |  *(_t764 + 0x18);
				_t510 =  *0x6802006e;
				 *_t510 =  *_t510 + _t510;
				 *_t510 =  *_t510 & _t510;
				_t511 = _t510 + 0x680b006e;
				 *_t511 =  *_t511 + _t511;
				 *_t511 =  *_t511 + _t511;
				_push(es);
				_t512 =  *0x6815006f;
				 *_t512 =  *_t512 + _t512;
				 *_t512 =  *_t512 & _t512;
				_t819 = _t818 |  *_t797;
				_push(es);
				_t513 = _t512 + 0x681e006f;
				 *_t513 =  *_t513 + _t513;
				 *_t513 =  *_t513 + _t513;
				_t647 =  &(_t636[1]);
				_t798 = _t797 | _t819;
				_t514 = _t513 | 0x0070058a;
				 *_t514 =  *_t514 - _t692;
				 *_t514 =  *_t514 + _t514;
				_t647[2] = _t647[2] + _t514;
				 *_t798 =  *_t798 + _t692;
				_t515 = _t514 + 0x68310070;
				 *_t515 =  *_t515 + _t515;
				 *_t515 =  *_t515 + _t515;
				_t799 = _t798 |  *(_t737 + 0xe);
				_t516 =  *0x683b0071;
				 *_t516 =  *_t516 + _t516;
				 *_t516 =  *_t516 & _t516;
				_t649 =  &(_t647[0]);
				_t517 = _t516 |  *(_t819 + 0x7105900e);
				 *((intOrPtr*)(_t517 + _t819 * 2)) =  *((intOrPtr*)(_t517 + _t819 * 2)) + _t517;
				 *_t517 =  *_t517 + _t517;
				_t649[2] = _t649[2] + _t517;
				 *0x72058a0b = _t517;
				 *((intOrPtr*)(_t799 + 0x68)) =  *((intOrPtr*)(_t799 + 0x68)) + _t692;
				 *_t517 =  *_t517 + _t517;
				 *_t517 =  *_t517 & _t517;
				_t820 = _t819 |  *(_t764 + 0x7205900b);
				 *((intOrPtr*)(_t764 + 0x68)) =  *((intOrPtr*)(_t764 + 0x68)) + _t737;
				 *_t517 =  *_t517 + _t517;
				 *_t517 =  *_t517 + _t517;
				asm("adc al, 0x7d");
				_t518 = _t517 + 0x68610073;
				 *_t518 =  *_t518 + _t518;
				 *_t518 =  *_t518 & _t518;
				_t800 = _t799;
				asm("adc al, 0x83");
				_t519 = _t518 + 0x686a0073;
				 *_t519 =  *_t519 + _t519;
				 *_t519 =  *_t519 + _t519;
				_t653 =  &(_t649[1]);
				_t738 = _t737 |  *(_t800 + 0x74057016);
				 *((intOrPtr*)(_t519 + _t820 * 2)) =  *((intOrPtr*)(_t519 + _t820 * 2)) + _t738;
				 *_t519 =  *_t519 + _t519;
				_t653[2] = _t653[2] + _t519;
				 *0x74057616 = _t519;
				 *((intOrPtr*)(_t764 + 0x68)) =  *((intOrPtr*)(_t764 + 0x68)) + _t738;
				_t344 =  &(_t653[2]);
				 *_t344 = _t653[2] + _t519;
				_t876 =  *_t344;
				asm("fisttp qword [ecx]");
				if(_t876 < 0) {
					if (_t876 != 0) goto L27;
					 *_t519 =  *_t519 >> 0;
				}
				 *_t519 =  *_t519 + _t519;
				_t653[2] = _t653[2] + _t519;
				asm("out dx, al");
				 *(_t653 - 0x35ff8afb) =  *(_t653 - 0x35ff8afb) | _t519;
				_push(0);
				asm("invalid");
				_t520 = _t519 + 0x68d40076;
				 *_t520 =  *_t520 + _t520;
				 *_t520 =  *_t520 & _t520;
				_t655 =  &(_t653[0]);
				_t694 = _t692 |  *(_t520 + 0xf);
				 *0x68e00076 =  *0x68e00076;
				 *_t520 =  *_t520 + _t520;
				 *_t694 =  *_t694 + _t520;
				 *((intOrPtr*)(_t520 + 0x77056802)) =  *((intOrPtr*)(_t520 + 0x77056802)) + _t694;
				 *((intOrPtr*)(_t738 + _t820 * 2)) =  *((intOrPtr*)(_t738 + _t820 * 2)) + _t694;
				 *_t520 =  *_t520 + _t520;
				_push(es);
				 *_t694 =  *_t694 + _t655;
				_push(_t520);
				asm("insb");
				 *_t520 =  *_t520 + _t520;
				 *_t520 =  *_t520 + _t520;
				 *_t520 =  *_t520 + _t520;
				_push(es);
				 *_t694 =  *_t694 + _t655;
				asm("adc al, 0x34");
				 *0x14 =  *0x14 + 0x14;
				 *0x14 =  *0x14 + 0x14;
				 *0x14 =  *0x14 + 0x14;
				asm("popad");
				_t821 = _t820 |  *0x00000019;
				if (_t821 >= 0) goto L29;
				asm("hlt");
				asm("insd");
				 *0x14 =  *0x14 + 0x14;
				 *0x14 =  *0x14 + 0x14;
				 *0x14 =  *0x14 + 0x14;
				_push(_t694);
				_t822 = _t821 |  *0x00000019;
				if (_t822 != 0) goto L30;
				asm("hlt");
				asm("outsd");
				 *0x14 =  *0x14 + 0x14;
				 *0x14 =  *0x14 + 0x14;
				 *0x14 =  *0x14 + 0x14;
				asm("int1");
				_t695 = _t694 |  *0x00000019;
				_t881 = _t695;
				if (_t881 >= 0) goto L31;
				_push(0x14);
				if (_t881 >= 0) goto L32;
				 *0x14 =  *0x14 + 0x14;
				 *_t695 =  *_t695 + 0x14;
				_t697 = _t695 + 0x00000014 |  *0x00000019;
				if (_t697 > 0) goto L33;
				 *0x14 =  *0x14 + 0x14;
				 *0x14 =  *0x14 + 0x14;
				 *0x14 =  *0x14 + 0x14;
				asm("retf 0x680a");
				 *0x73CC0095 =  *((intOrPtr*)(0x73cc0095)) + 0x14;
				 *((intOrPtr*)(0x73cc0095)) =  *((intOrPtr*)(0x73cc0095)) + 0x14;
				_push(es);
				 *0xFFFFFFFFF6CD419A =  *((intOrPtr*)(0xfffffffff6cd419a)) + 0x73cc0095;
				_t523 = 0x73cc00a9;
				_t884 = 0x73cc00a9;
				do {
					if (_t884 == 0) goto L35;
					 *_t523 =  *_t523 + _t523;
					 *_t800 =  *_t800 + _t523;
					asm("sbb [ecx+edx+0x830006], al");
					asm("in al, 0x74");
					 *_t523 =  *_t523 + _t523;
					 *_t523 =  *_t523 + _t523;
					asm("les eax, [edx]");
					_t525 = _t523 + 0x00830015 ^ 0x00000075;
					 *_t525 =  *_t525 + _t525;
					 *_t525 =  *_t525 + _t525;
					 *_t525 =  *_t525 + _t525;
					asm("aam 0x16");
					_push(es);
					 *((intOrPtr*)(_t525 + _t525 + 0x8084)) =  *((intOrPtr*)(_t525 + _t525 + 0x8084)) + _t525;
					 *_t525 =  *_t525 + _t525;
					_t656 =  &(_t655[0]);
					_t822 = _t822 |  *(_t822 + 0x16);
					if(_t822 >= 0) {
						 *_t525 =  *_t525;
					}
					 *_t525 =  *_t525 + _t525;
					_t374 =  &(_t656[2]);
					 *_t374 = _t656[2] + _t525;
					_t888 =  *_t374;
					if(_t888 == 0) {
						if(_t888 > 0) {
							asm("rol dword [eax], cl");
						}
						 *_t525 =  *_t525 + _t525;
						_t656[2] = _t656[2] + _t525;
						if(_t525 >=  *_t800) {
							asm("loopne 0xffffff82");
							 *_t525 =  *_t525 + _t525;
						}
						 *_t525 =  *_t525 + _t525;
					}
					 *_t525 =  *_t525 & _t525;
					_t655 =  &(_t656[0]);
					_t698 = _t697 |  *(_t697 + 6);
					if(_t698 > 0) {
						_t525 = _t525 &  *_t698;
					}
					 *_t525 =  *_t525 + _t525;
					_t655[2] = _t655[2] + _t525;
					 *_t525 =  *_t525 + _t738;
					 *_t525 =  *_t525 + 0x43002000;
					_t697 = _t698 | _t822;
					_t523 = _t525 + 0x860576;
				} while (_t523 >= 0);
				 *_t523 =  *_t523 + _t523;
				 *_t523 =  *_t523 + _t523;
				 *((intOrPtr*)( *_t523)) = _t523;
				 *((char*)((_t697 |  &(_t655[0])) + 0x200000)) =  *((char*)((_t697 |  &(_t655[0])) + 0x200000)) + 0x43;
			}

0x0016a11d
0x0016a11d
0x0016a11d
0x0016a11d
0x0016a11d
0x0016a11f
0x0016a122
0x0016a124
0x0016a126
0x0016a128
0x0016a12a
0x0016a131
0x0016a135
0x0016a137
0x0016a139
0x0016a13b
0x0016a140
0x0016a143
0x0016a145
0x0016a147
0x0016a14d
0x0016a154
0x0016a156
0x0016a158
0x0016a159
0x0016a15e
0x0016a160
0x0016a162
0x0016a166
0x0016a166
0x0016a167
0x0016a169
0x0016a16b
0x0016a16d
0x0016a16f
0x0016a171
0x0016a17a
0x0016a17c
0x0016a17e
0x0016a17f
0x0016a185
0x0016a187
0x0016a189
0x0016a18b
0x0016a18f
0x0016a192
0x0016a194
0x0016a196
0x0016a198
0x0016a19a
0x0016a19b
0x0016a1a2
0x0016a1a4
0x0016a1a6
0x0016a1a8
0x0016a1ab
0x0016a1b0
0x0016a1b2
0x0016a1b4
0x0016a1b6
0x0016a1b8
0x0016a1ba
0x0016a1bb
0x0016a1bd
0x0016a1bf
0x0016a1c1
0x0016a1c3
0x0016a1c5
0x0016a1cd
0x0016a1cf
0x0016a1d1
0x0016a1d3
0x0016a1d3
0x0016a1d6
0x0016a1d7
0x0016a1dd
0x0016a1df
0x0016a1e1
0x0016a1e7
0x0016a1ea
0x0016a1ec
0x0016a1ee
0x0016a1f0
0x0016a1f2
0x0016a1f3
0x0016a1f5
0x0016a1fb
0x0016a1fb
0x0016a1fe
0x0016a1fe
0x0016a1ff
0x0016a200
0x0016a202
0x0016a203
0x0016a203
0x0016a207
0x0016a209
0x0016a20c
0x0016a213
0x0016a216
0x0016a218
0x0016a21e
0x0016a21f
0x0016a221
0x0016a224
0x0016a226
0x0016a229
0x0016a22c
0x0016a22d
0x0016a22f
0x0016a230
0x0016a232
0x0016a235
0x0016a237
0x0016a239
0x0016a23e
0x0016a240
0x0016a242
0x0016a243
0x0016a246
0x0016a24d
0x0016a24f
0x0016a24f
0x0016a252
0x0016a254
0x0016a256
0x0016a258
0x0016a259
0x0016a25a
0x0016a25a
0x0016a25b
0x0016a25d
0x0016a260
0x0016a261
0x0016a267
0x0016a268
0x0016a26a
0x0016a273
0x0016a276
0x0016a278
0x0016a27a
0x0016a27b
0x0016a281
0x0016a284
0x0016a286
0x0016a289
0x0016a28c
0x0016a292
0x0016a294
0x0016a296
0x0016a297
0x0016a29d
0x0016a2a3
0x0016a2a6
0x0016a2ac
0x0016a2ad
0x0016a2ae
0x0016a2b0
0x0016a2b5
0x0016a2b7
0x0016a2bc
0x0016a2be
0x0016a2c3
0x0016a2c4
0x0016a2ca
0x0016a2cc
0x0016a2d1
0x0016a2d3
0x0016a2d8
0x0016a2da
0x0016a2e0
0x0016a2e6
0x0016a2e8
0x0016a2ea
0x0016a2ef
0x0016a2f4
0x0016a2f6
0x0016a301
0x0016a302
0x0016a304
0x0016a306
0x0016a307
0x0016a309
0x0016a30e
0x0016a30f
0x0016a310
0x0016a312
0x0016a315
0x0016a31b
0x0016a31d
0x0016a31e
0x0016a320
0x0016a323
0x0016a329
0x0016a32b
0x0016a32c
0x0016a32e
0x0016a335
0x0016a33a
0x0016a33c
0x0016a343
0x0016a348
0x0016a34a
0x0016a34c
0x0016a34d
0x0016a34f
0x0016a355
0x0016a357
0x0016a359
0x0016a35c
0x0016a361
0x0016a363
0x0016a365
0x0016a367
0x0016a36c
0x0016a36d
0x0016a372
0x0016a374
0x0016a376
0x0016a377
0x0016a379
0x0016a37f
0x0016a381
0x0016a383
0x0016a386
0x0016a387
0x0016a38d
0x0016a38f
0x0016a391
0x0016a394
0x0016a395
0x0016a39b
0x0016a39d
0x0016a39f
0x0016a3a2
0x0016a3a8
0x0016a3a9
0x0016a3ab
0x0016a3ad
0x0016a3b0
0x0016a3b2
0x0016a3b3
0x0016a3b8
0x0016a3ba
0x0016a3c1
0x0016a3c6
0x0016a3c8
0x0016a3cb
0x0016a3ce
0x0016a3cf
0x0016a3d4
0x0016a3d6
0x0016a3dc
0x0016a3dd
0x0016a3e2
0x0016a3e4
0x0016a3e7
0x0016a3eb
0x0016a3f0
0x0016a3f2
0x0016a3f4
0x0016a3f5
0x0016a3f7
0x0016a3fd
0x0016a3ff
0x0016a401
0x0016a406
0x0016a407
0x0016a40c
0x0016a40e
0x0016a411
0x0016a417
0x0016a41f
0x0016a421
0x0016a427
0x0016a429
0x0016a42b
0x0016a42e
0x0016a42f
0x0016a435
0x0016a437
0x0016a439
0x0016a43c
0x0016a43e
0x0016a43f
0x0016a444
0x0016a446
0x0016a449
0x0016a44d
0x0016a452
0x0016a454
0x0016a456
0x0016a457
0x0016a45a
0x0016a45b
0x0016a460
0x0016a462
0x0016a464
0x0016a466
0x0016a468
0x0016a468
0x0016a46a
0x0016a46c
0x0016a46d
0x0016a46f
0x0016a471
0x0016a473
0x0016a479
0x0016a47c
0x0016a47e
0x0016a480
0x0016a484
0x0016a485
0x0016a487
0x0016a48a
0x0016a48c
0x0016a48e
0x0016a490
0x0016a491
0x0016a494
0x0016a495
0x0016a499
0x0016a49b
0x0016a49d
0x0016a49f
0x0016a4a2
0x0016a4a9
0x0016a4ab
0x0016a4b1
0x0016a4b7
0x0016a4b9
0x0016a4c5
0x0016a4c7
0x0016a4cb
0x0016a4cd
0x0016a4cf
0x0016a4d0
0x0016a4d2
0x0016a4d4
0x0016a4d7
0x0016a4dc
0x0016a4de
0x0016a4e0
0x0016a4e2
0x0016a4e4
0x0016a4e6
0x0016a4e7
0x0016a4e9
0x0016a4ed
0x0016a4f1
0x0016a4f8
0x0016a4fb
0x0016a507
0x0016a508
0x0016a50a
0x0016a50c
0x0016a50e
0x0016a510
0x0016a511
0x0016a516
0x0016a518
0x0016a51a
0x0016a51c
0x0016a51e
0x0016a521
0x0016a523
0x0016a524
0x0016a526
0x0016a528
0x0016a529
0x0016a52c
0x0016a52d
0x0016a532
0x0016a534
0x0016a536
0x0016a537
0x0016a53a
0x0016a53b
0x0016a53d
0x0016a540
0x0016a542
0x0016a544
0x0016a545
0x0016a54b
0x0016a54e
0x0016a550
0x0016a552
0x0016a553
0x0016a559
0x0016a55b
0x0016a55c
0x0016a55e
0x0016a560
0x0016a561
0x0016a564
0x0016a566
0x0016a568
0x0016a56a
0x0016a56c
0x0016a56e
0x0016a575
0x0016a578
0x0016a57a
0x0016a57c
0x0016a57e
0x0016a57f
0x0016a586
0x0016a588
0x0016a58a
0x0016a58b
0x0016a58d
0x0016a594
0x0016a596
0x0016a59f
0x0016a5a1
0x0016a5a2
0x0016a5a4
0x0016a5a6
0x0016a5a7
0x0016a5a7
0x0016a5ad
0x0016a5b0
0x0016a5b2
0x0016a5b8
0x0016a5be
0x0016a5c0
0x0016a5c3
0x0016a5c9
0x0016a5cc
0x0016a5ce
0x0016a5d1
0x0016a5d3
0x0016a5d8
0x0016a5da
0x0016a5dc
0x0016a5e1
0x0016a5e3
0x0016a5e8
0x0016a5ea
0x0016a5ef
0x0016a5f0
0x0016a5f6
0x0016a5f8
0x0016a5ff
0x0016a604
0x0016a606
0x0016a609
0x0016a60c
0x0016a612
0x0016a614
0x0016a61b
0x0016a620
0x0016a622
0x0016a625
0x0016a62b
0x0016a62d
0x0016a62e
0x0016a630
0x0016a632
0x0016a633
0x0016a635
0x0016a63a
0x0016a63d
0x0016a63f
0x0016a647
0x0016a649
0x0016a64a
0x0016a64c
0x0016a64e
0x0016a64f
0x0016a655
0x0016a659
0x0016a65b
0x0016a65e
0x0016a661
0x0016a666
0x0016a668
0x0016a66f
0x0016a674
0x0016a676
0x0016a678
0x0016a679
0x0016a67f
0x0016a683
0x0016a685
0x0016a688
0x0016a68d
0x0016a693
0x0016a696
0x0016a697
0x0016a69a
0x0016a6a5
0x0016a6ab
0x0016a6ac
0x0016a6ae
0x0016a6b7
0x0016a6ba
0x0016a6bc
0x0016a6c5
0x0016a6c7
0x0016a6c8
0x0016a6ca
0x0016a6cd
0x0016a6d3
0x0016a6d6
0x0016a6d8
0x0016a6da
0x0016a6db
0x0016a6e2
0x0016a6e7
0x0016a6ea
0x0016a6ef
0x0016a6f2
0x0016a6f4
0x0016a6fa
0x0016a6fb
0x0016a700
0x0016a702
0x0016a708
0x0016a709
0x0016a70e
0x0016a710
0x0016a717
0x0016a71c
0x0016a71e
0x0016a723
0x0016a72a
0x0016a72c
0x0016a72e
0x0016a731
0x0016a738
0x0016a73a
0x0016a73d
0x0016a743
0x0016a746
0x0016a748
0x0016a74b
0x0016a74d
0x0016a754
0x0016a756
0x0016a759
0x0016a75b
0x0016a762
0x0016a764
0x0016a766
0x0016a769
0x0016a770
0x0016a772
0x0016a779
0x0016a77e
0x0016a780
0x0016a782
0x0016a786
0x0016a787
0x0016a78c
0x0016a78e
0x0016a790
0x0016a792
0x0016a796
0x0016a797
0x0016a79d
0x0016a7a4
0x0016a7a7
0x0016a7a8
0x0016a7aa
0x0016a7ac
0x0016a7ad
0x0016a7b3
0x0016a7ba
0x0016a7bb
0x0016a7c2
0x0016a7c4
0x0016a7c6
0x0016a7c8
0x0016a7cb
0x0016a7d0
0x0016a7d2
0x0016a7d4
0x0016a7d6
0x0016a7d8
0x0016a7db
0x0016a7e0
0x0016a7e2
0x0016a7e5
0x0016a7e7
0x0016a7ec
0x0016a7ed
0x0016a7ee
0x0016a7f0
0x0016a7f2
0x0016a7f6
0x0016a7fd
0x0016a7ff
0x0016a802
0x0016a803
0x0016a808
0x0016a80b
0x0016a80d
0x0016a816
0x0016a818
0x0016a81a
0x0016a81c
0x0016a81d
0x0016a81f
0x0016a823
0x0016a825
0x0016a826
0x0016a828
0x0016a82d
0x0016a830
0x0016a831
0x0016a833
0x0016a834
0x0016a836
0x0016a838
0x0016a839
0x0016a83f
0x0016a843
0x0016a845
0x0016a848
0x0016a84d
0x0016a853
0x0016a853
0x0016a856
0x0016a858
0x0016a85a
0x0016a85b
0x0016a85b
0x0016a85f
0x0016a861
0x0016a864
0x0016a866
0x0016a86d
0x0016a86f
0x0016a872
0x0016a874
0x0016a877
0x0016a87a
0x0016a87c
0x0016a885
0x0016a888
0x0016a88a
0x0016a88f
0x0016a891
0x0016a896
0x0016a898
0x0016a89a
0x0016a89b
0x0016a89f
0x0016a8a4
0x0016a8a6
0x0016a8a9
0x0016a8af
0x0016a8b1
0x0016a8b2
0x0016a8b4
0x0016a8b6
0x0016a8bd
0x0016a8c0
0x0016a8c2
0x0016a8c4
0x0016a8cb
0x0016a8ce
0x0016a8d0
0x0016a8d2
0x0016a8d4
0x0016a8d5
0x0016a8d7
0x0016a8dc
0x0016a8de
0x0016a8e0
0x0016a8e7
0x0016a8e9
0x0016a8ea
0x0016a8ec
0x0016a8ee
0x0016a8f5
0x0016a8f7
0x0016a8f8
0x0016a8fa
0x0016a8fc
0x0016a8fe
0x0016a901
0x0016a906
0x0016a908
0x0016a90a
0x0016a90c
0x0016a911
0x0016a914
0x0016a916
0x0016a918
0x0016a91e
0x0016a91f
0x0016a925
0x0016a927
0x0016a929
0x0016a92c
0x0016a92d
0x0016a92f
0x0016a930
0x0016a932
0x0016a935
0x0016a93c
0x0016a93e
0x0016a940
0x0016a942
0x0016a94b
0x0016a94c
0x0016a94e
0x0016a950
0x0016a952
0x0016a954
0x0016a955
0x0016a958
0x0016a95c
0x0016a963
0x0016a968
0x0016a96a
0x0016a96d
0x0016a970
0x0016a971
0x0016a976
0x0016a978
0x0016a97b
0x0016a97d
0x0016a983
0x0016a986
0x0016a988
0x0016a98b
0x0016a991
0x0016a994
0x0016a99d
0x0016a99f
0x0016a9a2
0x0016a9a5
0x0016a9a7
0x0016a9ad
0x0016a9b0
0x0016a9b5
0x0016a9bb
0x0016a9be
0x0016a9c0
0x0016a9c3
0x0016a9c9
0x0016a9cc
0x0016a9d3
0x0016a9d8
0x0016a9da
0x0016a9dd
0x0016a9e1
0x0016a9e6
0x0016a9e8
0x0016a9ee
0x0016a9ef
0x0016a9f4
0x0016a9f6
0x0016a9fc
0x0016a9fd
0x0016aa02
0x0016aa04
0x0016aa06
0x0016aa07
0x0016aa0d
0x0016aa13
0x0016aa16
0x0016aa18
0x0016aa19
0x0016aa1e
0x0016aa20
0x0016aa29
0x0016aa2c
0x0016aa2e
0x0016aa30
0x0016aa37
0x0016aa3a
0x0016aa3c
0x0016aa3e
0x0016aa3f
0x0016aa45
0x0016aa48
0x0016aa4a
0x0016aa4c
0x0016aa4d
0x0016aa4f
0x0016aa55
0x0016aa58
0x0016aa5b
0x0016aa5d
0x0016aa63
0x0016aa66
0x0016aa68
0x0016aa6f
0x0016aa72
0x0016aa74
0x0016aa76
0x0016aa77
0x0016aa7c
0x0016aa81
0x0016aa83
0x0016aa86
0x0016aa87
0x0016aa8d
0x0016aa90
0x0016aa92
0x0016aa99
0x0016aa9b
0x0016aa9e
0x0016aaa0
0x0016aaa1
0x0016aaa3
0x0016aaa8
0x0016aaa9
0x0016aaac
0x0016aaae
0x0016aaaf
0x0016aab1
0x0016aab2
0x0016aab4
0x0016aab4
0x0016aab9
0x0016aabb
0x0016aabe
0x0016aabf
0x0016aac0
0x0016aac2
0x0016aac2
0x0016aac7
0x0016aac9
0x0016aac9
0x0016aac9
0x0016aacc
0x0016aacd
0x0016aace
0x0016aad5
0x0016aad5
0x0016aad7
0x0016aad7
0x0016aad7
0x0016aada
0x0016aadc
0x0016aade
0x0016aae0
0x0016aae0
0x0016aae3
0x0016aae5
0x0016aae8
0x0016aaeb
0x0016aaf0
0x0016aaf0
0x0016aaf2
0x0016aaf9
0x0016aafe
0x0016ab00
0x0016ab02
0x0016ab03
0x0016ab09
0x0016ab0b
0x0016ab0e
0x0016ab10
0x0016ab11
0x0016ab17
0x0016ab19
0x0016ab1c
0x0016ab1f
0x0016ab25
0x0016ab27
0x0016ab2a
0x0016ab2c
0x0016ab2d
0x0016ab2f
0x0016ab34
0x0016ab35
0x0016ab38
0x0016ab3a
0x0016aad0
0x0016aad0
0x0016aad2
0x0016aad4
0x00000000
0x0016aad4
0x0016aad2
0x0016ab3b
0x0016ab3e
0x0016ab44
0x0016ab46
0x0016ab4d
0x0016ab52
0x0016ab54
0x0016ab59
0x0016ab5a
0x0016ab60
0x0016ab62
0x0016ab65
0x0016ab67
0x0016ab69
0x0016ab6e
0x0016ab70
0x0016ab72
0x0016ab73
0x0016ab75
0x0016ab7a
0x0016ab7d
0x0016ab7f
0x0016ab82
0x0016ab85
0x0016ab8a
0x0016ab8c
0x0016ab8f
0x0016ab92
0x0016ab98
0x0016ab9a
0x0016ab9c
0x0016ab9d
0x0016aba3
0x0016aba7
0x0016aba9
0x0016abac
0x0016abb1
0x0016abb4
0x0016abb6
0x0016abb9
0x0016abbf
0x0016abc2
0x0016abc4
0x0016abc9
0x0016abcb
0x0016abd0
0x0016abd2
0x0016abd5
0x0016abd7
0x0016abd9
0x0016abde
0x0016abe0
0x0016abe2
0x0016abe3
0x0016abe9
0x0016abed
0x0016abef
0x0016abf2
0x0016abf7
0x0016abfd
0x0016abfd
0x0016abfd
0x0016ac00
0x0016ac02
0x0016ac04
0x0016ac06
0x0016ac06
0x0016ac09
0x0016ac0b
0x0016ac0e
0x0016ac0f
0x0016ac15
0x0016ac1d
0x0016ac1f
0x0016ac24
0x0016ac26
0x0016ac28
0x0016ac29
0x0016ac2c
0x0016ac33
0x0016ac35
0x0016ac37
0x0016ac3d
0x0016ac44
0x0016ac48
0x0016ac49
0x0016ac4c
0x0016ac4d
0x0016ac4e
0x0016ac50
0x0016ac52
0x0016ac56
0x0016ac57
0x0016ac5a
0x0016ac5c
0x0016ac5e
0x0016ac60
0x0016ac62
0x0016ac63
0x0016ac66
0x0016ac68
0x0016ac69
0x0016ac6a
0x0016ac6c
0x0016ac6e
0x0016ac70
0x0016ac71
0x0016ac74
0x0016ac76
0x0016ac77
0x0016ac78
0x0016ac7a
0x0016ac7c
0x0016ac7e
0x0016ac7f
0x0016ac7f
0x0016ac82
0x0016ac84
0x0016ac85
0x0016ac87
0x0016ac89
0x0016ac8d
0x0016ac90
0x0016ac94
0x0016ac96
0x0016ac98
0x0016ac9a
0x0016aca2
0x0016aca4
0x0016aca6
0x0016aca7
0x0016acad
0x0016acad
0x0016acaf
0x0016acaf
0x0016acb1
0x0016acb3
0x0016acb5
0x0016acbc
0x0016acbe
0x0016acc0
0x0016acc2
0x0016acca
0x0016accc
0x0016acce
0x0016acd0
0x0016acd2
0x0016acd4
0x0016acd5
0x0016acdc
0x0016acde
0x0016acdf
0x0016ace2
0x0016ace7
0x0016ace7
0x0016ace9
0x0016aceb
0x0016aceb
0x0016aceb
0x0016acee
0x0016acf0
0x0016acf4
0x0016acf4
0x0016acf7
0x0016acf9
0x0016acfe
0x0016ad02
0x0016ad04
0x0016ad04
0x0016ad05
0x0016ad05
0x0016ad06
0x0016ad08
0x0016ad09
0x0016ad0c
0x0016ad10
0x0016ad10
0x0016ad13
0x0016ad15
0x0016ad1d
0x0016ad1f
0x0016ad25
0x0016ad27
0x0016ad27
0x0016ad2e
0x0016ad30
0x0016ad38
0x0016ad3a

Memory Dump Source

Source File: 00000000.00000002.299194982.0000000000162000.00000002.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.299183965.0000000000160000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825733ecb210eadf19fcc7a1c94d27ab25aad8c72cf25f9c3b14bc2eb16bc045
Instruction ID: da8db4c29f960bc9ca75e6877e761d5d1cbbb97240e93dde5aa56de924cbfb52
Opcode Fuzzy Hash: 825733ecb210eadf19fcc7a1c94d27ab25aad8c72cf25f9c3b14bc2eb16bc045
Instruction Fuzzy Hash: 5532026684E3D15FD3478B718CA52827FB0AE2325471E82EBC8D5CF4A3E219591AC773

Uniqueness

Uniqueness Score: -1.00%

Function 0232E560 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c9f48d0cf337f2f777133fb2a4eff97952b0d8d8d2c137d137a2646fb9adab0
Instruction ID: 1fecb0a5120d1a1f25563673caaa7371d6d0e671fbd99f26106002d87eb15f59
Opcode Fuzzy Hash: 8c9f48d0cf337f2f777133fb2a4eff97952b0d8d8d2c137d137a2646fb9adab0
Instruction Fuzzy Hash: 7A12A7F1611F46CAD730CF65ED9828A3BA1B765328B904308D2612BEF1DFB8158ACF54

Uniqueness

Uniqueness Score: -1.00%

Function 0232BCD4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62fbce1b3ce1b25ad1c91e5248f8844c7aedbcbc90280c6c82a55b6b14256e6
Instruction ID: 3d68734a622b03ab746dae1382fbcd197cbb21dc0b5452e7fd0b29e7be9dac84
Opcode Fuzzy Hash: e62fbce1b3ce1b25ad1c91e5248f8844c7aedbcbc90280c6c82a55b6b14256e6
Instruction Fuzzy Hash: F3A16B32E00629CFCF15DFA5C8445DEBBB2FF89300B15856AE805BB225EB31A949CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0232E550 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301198468.0000000002320000.00000040.00000800.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2320000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ffea6a55bcb93132c22febeb62ce7a652688ba8bdc2797c38449639271b599c
Instruction ID: db46b9c97ebd3f98ea812d3cd2a5b5a7a2229ba270c5354a98692b41098d8ca3
Opcode Fuzzy Hash: 4ffea6a55bcb93132c22febeb62ce7a652688ba8bdc2797c38449639271b599c
Instruction Fuzzy Hash: 16C1FBB1611B46CBD720DF65ED8828A7B71BBA5328F504318D1616BEF0DFB8248ACF54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: INV00987890.exePID: 6764, Parent PID: 6468COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	60
Total number of Limit Nodes:	2

Executed Functions

Function 069CB228 Relevance: 1.6, APIs: 1, Instructions: 148
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 069CB287

Memory Dump Source

Source File: 00000004.00000002.533560017.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_69c0000_INV00987890.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6b32d5c9d236ab93ac931021ae13fcdf10cda6f2fdbb884fb362bcac79bcbab1
Instruction ID: f2a3160543e53dd69f5ffd25f378eb794c05636cc1c0986de4ee445800f81445
Opcode Fuzzy Hash: 6b32d5c9d236ab93ac931021ae13fcdf10cda6f2fdbb884fb362bcac79bcbab1
Instruction Fuzzy Hash: 9D51C270B142059FCB44EFB4C899AAEB7B6BF88210F14866DD5129B784EF30D845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 069C0040 Relevance: 1.7, APIs: 1, Instructions: 185
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 069C0081

Memory Dump Source

Source File: 00000004.00000002.533560017.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_69c0000_INV00987890.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1d8202f219d8d51741b2285adb99555ad7eca8fc76e86854d7efb64c70d25bb2
Instruction ID: 7733db1cfa73de46c282030826a43ebcd6d20c9ac69b93e703ac77f5b7c7aebc
Opcode Fuzzy Hash: 1d8202f219d8d51741b2285adb99555ad7eca8fc76e86854d7efb64c70d25bb2
Instruction Fuzzy Hash: EF714934E01209DFDB54EFB4D5587AEBBF2AF88314F108829D402A7794DB75E986CB81

Uniqueness

Uniqueness Score: -1.00%

Function 069CB217 Relevance: 1.6, APIs: 1, Instructions: 146
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 069CB287

Memory Dump Source

Source File: 00000004.00000002.533560017.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_69c0000_INV00987890.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5c9b5ee0be90677bfe4ece7fc82035682ba476edf1b3811a21255c40a12ccb37
Instruction ID: b266f50d5c86fcd534b5e2e62955069f5ea79a68d3d3a71cf0be5ee8823dfe37
Opcode Fuzzy Hash: 5c9b5ee0be90677bfe4ece7fc82035682ba476edf1b3811a21255c40a12ccb37
Instruction Fuzzy Hash: 4551E530A142059FCB44EFB4C899AEEB7B5FF89210F14856EE4129B795EF30D845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0698B429 Relevance: 1.6, APIs: 1, Instructions: 121
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,00000000,?,00000001,?), ref: 0698B53C

Memory Dump Source

Source File: 00000004.00000002.533488656.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6980000_INV00987890.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4d9ebf0faf15c1c39b0ca3ca0d0587dfee12c8bf757f25266c9e834c8e4ea14e
Instruction ID: 97bde0e4f06c8395bded06d942d97fa5ebbdc44fa80c52143334492ec47b0418
Opcode Fuzzy Hash: 4d9ebf0faf15c1c39b0ca3ca0d0587dfee12c8bf757f25266c9e834c8e4ea14e
Instruction Fuzzy Hash: 4D417970E053499FDB00CFA9C944B8EFFF9AF49314F29816AE408AB345C7759985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0698B6F0 Relevance: 1.6, APIs: 1, Instructions: 115
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 0698B7F9

Memory Dump Source

Source File: 00000004.00000002.533488656.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6980000_INV00987890.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 673a46eb110a797a7ef9dc9c710f5903a7bb8912ff8408e97fa82af40180faab
Instruction ID: f2502ecce6398e39d7725921eb1dbe4b36dd7d6482aef73d51f43e41f8549b33
Opcode Fuzzy Hash: 673a46eb110a797a7ef9dc9c710f5903a7bb8912ff8408e97fa82af40180faab
Instruction Fuzzy Hash: 7B4136B1E013599FCB10DF99C884A9EBBF5BF48704F25806AE819AB744D7309806CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 016ECFE4 Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 016ED0BA

Memory Dump Source

Source File: 00000004.00000002.529019618.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_16e0000_INV00987890.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dfac51f8459f5ac4a477ea1d642849781e9ad69f0dc79412092691b4bd35fdd9
Instruction ID: 78d2e8691fef2667155e8a9320ac94827eceb7827c9f83307a8ae6a928f342c0
Opcode Fuzzy Hash: dfac51f8459f5ac4a477ea1d642849781e9ad69f0dc79412092691b4bd35fdd9
Instruction Fuzzy Hash: A03146B1D052499FDB14CFA8C88979EBFF1BB09314F18862DE815A7380D774A486CF92

Uniqueness

Uniqueness Score: -1.00%

Function 016E9E1C Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 016ED0BA

Memory Dump Source

Source File: 00000004.00000002.529019618.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_16e0000_INV00987890.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 880d07b973ae92e2f58f498b063ebcb6d61079c469443b6f5af422edd4360959
Instruction ID: 2220088f05027c4e29fbfd80ed2aee1ffa1fcd2d59e9810b28a2fb34894faba8
Opcode Fuzzy Hash: 880d07b973ae92e2f58f498b063ebcb6d61079c469443b6f5af422edd4360959
Instruction Fuzzy Hash: D13146B0D052499FDB14CFA8C88979EBFF1BB48314F188629E815A7380D7749486CF92

Uniqueness

Uniqueness Score: -1.00%

Function 06987DD0 Relevance: 1.6, APIs: 1, Instructions: 88
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 0698B7F9

Memory Dump Source

Source File: 00000004.00000002.533488656.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6980000_INV00987890.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f1e1a6db6c9a9349655843330facc11af82df6599a07cfba70a884cbbf029e4c
Instruction ID: 665d16906a0f64b8a690b6779503beefaaed47a7a99cc18a31cc09c7145ba3b2
Opcode Fuzzy Hash: f1e1a6db6c9a9349655843330facc11af82df6599a07cfba70a884cbbf029e4c
Instruction Fuzzy Hash: 2431FFB1D002599FCB10DF9AC984A9EFFF5BF48314F58842AE819AB714D770A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06987DC4 Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,00000000,?,00000001,?), ref: 0698B53C

Memory Dump Source

Source File: 00000004.00000002.533488656.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6980000_INV00987890.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 22805a41159f94192b2cac2b7df9fef650c77083f0d7ec6ea85e5dbef4dc84f7
Instruction ID: babd9153374183e0328e872b1fbb6149ff741343154007db49561909e4547c9b
Opcode Fuzzy Hash: 22805a41159f94192b2cac2b7df9fef650c77083f0d7ec6ea85e5dbef4dc84f7
Instruction Fuzzy Hash: 393110B0D043488FDB10DF99C584A8EFBF5BF48314F28856AE809AB305C775A985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 069C0006 Relevance: 1.6, APIs: 1, Instructions: 82libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 069C0081

Memory Dump Source

Source File: 00000004.00000002.533560017.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_69c0000_INV00987890.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c2dd0cb20f2db5a35af7fd3fb4dd15068025f5522d4579fd4b0ac483fcf45ee8
Instruction ID: eac5714f05c0de69b90dd320c6f3b0bea4cd9baf96cd38106f40fdf4ca598caf
Opcode Fuzzy Hash: c2dd0cb20f2db5a35af7fd3fb4dd15068025f5522d4579fd4b0ac483fcf45ee8
Instruction Fuzzy Hash: BB31CE30905385DFCB16DFA1C86469EBFB2FF46314F1544A9D0419B792C73A9C4ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 016E4CD8 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 016E4D62

Memory Dump Source

Source File: 00000004.00000002.529019618.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_16e0000_INV00987890.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 4fd747debb06f71ba58bd222e0416695b539098af788939293d2b3f81f3e1485
Instruction ID: 6efac4667ff45bc0342552270dc2b45e7de8ab4bb8f349586b9da5bb3762b6d9
Opcode Fuzzy Hash: 4fd747debb06f71ba58bd222e0416695b539098af788939293d2b3f81f3e1485
Instruction Fuzzy Hash: 152167B29113498FCB20DFA9C84979EBBF8FB48314F148969D504E3741CB39A548CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 016E4CE8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 016E4D62

Memory Dump Source

Source File: 00000004.00000002.529019618.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_16e0000_INV00987890.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 97f789265ba89f27997d1910c6d823b3556863885b5ec9e97656d10df46b66a6
Instruction ID: 4f3398aa6746962d09e9c14ac37a4897d69f50d7f185c8f81405d819735d3273
Opcode Fuzzy Hash: 97f789265ba89f27997d1910c6d823b3556863885b5ec9e97656d10df46b66a6
Instruction Fuzzy Hash: E511A9B29013498FCB20DFAAC80879EBBF8FB48314F208929D404E3741CB39A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014AE16A Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.528777340.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14ad000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de827dd7abded6a125436147ccbbaf9c35815e054b72fc512469d9d52eaacb3
Instruction ID: 6b13d91a8a0c34ee8b169b4d7edabc06dfa23479a4ef298bef125053331ab541
Opcode Fuzzy Hash: 2de827dd7abded6a125436147ccbbaf9c35815e054b72fc512469d9d52eaacb3
Instruction Fuzzy Hash: 5581067150E7C09FC3038B3098A4A967F71AF17214F1E41EBD4C4EF6A3E26A591AC762

Uniqueness

Uniqueness Score: -1.00%

Function 0149D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.528746139.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_149d000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c258419e00879f17efb06302bb8c4b320c7b2bc4b233d07fc7616b3852076b
Instruction ID: b2b691a09eaa88b843191abbd69802feb64930331f582f1fb7fc8264533b5556
Opcode Fuzzy Hash: b8c258419e00879f17efb06302bb8c4b320c7b2bc4b233d07fc7616b3852076b
Instruction Fuzzy Hash: 4021F471904244DFDF05DF54D9C0B27BF65FB88328F24856AE9054B366C336D856C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0149D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.528746139.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_149d000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e592ec263ad1ca6218a4f68a47cbcfb448d42e912724331da5b5ceeea16f318
Instruction ID: 367667710941464ba156821de5add0caa73bfd0a436eb58a0ea91b0c29fb0371
Opcode Fuzzy Hash: 2e592ec263ad1ca6218a4f68a47cbcfb448d42e912724331da5b5ceeea16f318
Instruction Fuzzy Hash: 362100B1904244DFCF05DF94C9C0B6ABF65FB88224F24C57AE9090B216C33AE846C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 014AE3F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.528777340.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14ad000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7344ca9e85524166eefcfa28eae14f737aca4883324a2cab4c4515d8b571590d
Instruction ID: d406d26a226a9b7c66b987e94b2b847cd8f25b8a25a4562b9ada0de809ed25fa
Opcode Fuzzy Hash: 7344ca9e85524166eefcfa28eae14f737aca4883324a2cab4c4515d8b571590d
Instruction Fuzzy Hash: A9217C71508204DFCB01CF14D8C0B16BB69FB84324F24C97ED9095B356C33AD846C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0149D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.528746139.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_149d000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e12181f863a64cfe501b52ed0dc6072a2b21c790c3d1261feacc9d3857e76c6
Instruction ID: e1744f064f0c11fa0e5df4eaab12bba516cee43ac48b5c030f7c57fc13914c04
Opcode Fuzzy Hash: 9e12181f863a64cfe501b52ed0dc6072a2b21c790c3d1261feacc9d3857e76c6
Instruction Fuzzy Hash: D711AF76904284CFCF12CF54D5C4B16BF71FB84324F2486AAD8050B766C33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0149D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.528746139.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_149d000_INV00987890.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e12181f863a64cfe501b52ed0dc6072a2b21c790c3d1261feacc9d3857e76c6
Instruction ID: c9af0b15b296e9c8b8057f9effdb4d11c00273e232fbdd2dd7b1d29aa929f6d8
Opcode Fuzzy Hash: 9e12181f863a64cfe501b52ed0dc6072a2b21c790c3d1261feacc9d3857e76c6
Instruction Fuzzy Hash: 1911A276904244DFCF16CF54D5C4B56BF61FB84320F24C6AAD8080B756C33AD456CBA1

Uniqueness

Uniqueness Score: -1.00%

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.215.253.210	Port Agency Appointment.xlsx	Get hash	malicious	Browse	richelon.in/NewEx/098766890767_Scan.exe
	DHL Parcel Details.xlsx	Get hash	malicious	Browse	richelon.in/NewEx/087655888678_doc.exe
	CompensationClaim-46373845-02032021.xls	Get hash	malicious	Browse	www.yoast.in/wevzgfqr/416212.jpg
	CompensationClaim-46373845-02032021.xls	Get hash	malicious	Browse	www.yoast.in/wevzgfqr/416212.jpg
	DHL Documents_AWB_001173980920AD.xlsx	Get hash	malicious	Browse	richelon.in/NewEx/scan0876578909.exe
	PO#4503527426.xlsx	Get hash	malicious	Browse	richelon.in/NewEx/doc09876578.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	6gIL6GLh9R	Get hash	malicious	Browse	119.18.52.5
	SOA.exe	Get hash	malicious	Browse	111.118.215.27
	G4tQVT2iUBOkX0S.exe	Get hash	malicious	Browse	162.215.253.210
	Statement of Account (SOA).exe	Get hash	malicious	Browse	162.251.80.27
	SecuriteInfo.com.W32.AIDetectNet.01.12288.exe	Get hash	malicious	Browse	208.91.198.46
	SecuriteInfo.com.W32.AIDetectNet.01.3171.exe	Get hash	malicious	Browse	208.91.198.38
	SecuriteInfo.com.Trojan.PWS.StealerNET.122.28104.exe	Get hash	malicious	Browse	162.222.225.29
	SecuriteInfo.com.W32.AIDetectNet.01.14190.exe	Get hash	malicious	Browse	162.222.225.29
	SecuriteInfo.com.W32.AIDetectNet.01.11498.exe	Get hash	malicious	Browse	162.222.225.29
	PO#5072.exe	Get hash	malicious	Browse	208.91.198.46
	SecuriteInfo.com.W32.AIDetectNet.01.19565.exe	Get hash	malicious	Browse	162.222.225.16
	SecuriteInfo.com.Trojan.PackedNET.1352.29751.exe	Get hash	malicious	Browse	208.91.198.46
	http://6nreijjndg03nhn.tuarquetipo.com./#aHR0cHM6Ly93d3cuY3ZlZ2ozajg3LnRvcC8/ZW1haWw9YW1pdGFiaGEucmF5QHNjaHJlaWJlcmZvb2RzLmNvbQ==	Get hash	malicious	Browse	208.91.198.109
	Purchase_order_#133.exe	Get hash	malicious	Browse	208.91.198.38
	PO-INQUIRY-VALE-SP-2022-60.pdf.exe	Get hash	malicious	Browse	208.91.198.46
	SecuriteInfo.com.W32.AIDetectNet.01.20179.exe	Get hash	malicious	Browse	208.91.198.38
	SCAN Swift 054545676700000000000000001.exe	Get hash	malicious	Browse	103.211.219.10
	SecuriteInfo.com.W32.AIDetectNet.01.7467.exe	Get hash	malicious	Browse	162.222.225.29
	00012878667899DOC.exe	Get hash	malicious	Browse	162.215.253.210
	URGENT QUOTATIONS.exe	Get hash	malicious	Browse	162.251.80.27

Target ID:	0
Start time:	16:21:17
Start date:	27/05/2022
Path:	C:\Users\user\Desktop\INV00987890.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\INV00987890.exe"
Imagebase:	0x160000
File size:	518144 bytes
MD5 hash:	FE5CAB253EF5708D03DD6970E105B6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.306417687.000000000345F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.306417687.000000000345F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Target ID:	4
Start time:	16:21:34
Start date:	27/05/2022
Path:	C:\Users\user\Desktop\INV00987890.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xe30000
File size:	518144 bytes
MD5 hash:	FE5CAB253EF5708D03DD6970E105B6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.526824095.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.526824095.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.295217525.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.295217525.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.296078130.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.296078130.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.295669546.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.295669546.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.296713839.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.296713839.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.529292759.0000000003171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report INV00987890.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INV00987890.exe.log

C:\Windows\System32\drivers\etc\hosts

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
INV00987890.exe

Function 023294C8 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Function 0232DAFC Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 0232FCCC Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Function 0232B9A4 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0232BDD9 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 02329928 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Function 02328870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 023296A8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 0232DB34 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 0232FF18 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Function 0444094B Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Function 04440950 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Function 04440040 Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Function 0444003B Relevance: 1.5, APIs: 1, Instructions: 43
threadCOMMON

Function 0016A11D Relevance: .6, Instructions: 587
COMMONCrypto

Function 069CB228 Relevance: 1.6, APIs: 1, Instructions: 148
libraryCOMMON

Function 069C0040 Relevance: 1.7, APIs: 1, Instructions: 185
libraryCOMMON

Function 069CB217 Relevance: 1.6, APIs: 1, Instructions: 146
libraryCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre