Edit tour

Windows Analysis Report
l9qmoY93Ed.exe

Overview

General Information

Sample Name:	l9qmoY93Ed.exe
Analysis ID:	708248
MD5:	fb561127230e7104e2df440f2712581e
SHA1:	62741306fbb863c7def4a3cc21175a3badf59f14
SHA256:	48929d6ac22fe9d2edee0e1ea483b143786d3b0965be5c771eb6a2d90018df21
Tags:	exeSnakeKeylogger
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Yara detected AntiVM3

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

May check the online IP address of the machine

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

l9qmoY93Ed.exe (PID: 5956 cmdline: "C:\Users\user\Desktop\l9qmoY93Ed.exe" MD5: FB561127230E7104E2DF440F2712581E)

l9qmoY93Ed.exe (PID: 3276 cmdline: C:\Users\user\Desktop\l9qmoY93Ed.exe MD5: FB561127230E7104E2DF440F2712581E)

l9qmoY93Ed.exe (PID: 4460 cmdline: C:\Users\user\Desktop\l9qmoY93Ed.exe MD5: FB561127230E7104E2DF440F2712581E)

cleanup

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "yugolog@gthltd.buzz", "Password": "7213575aceACE@#$", "Host": "cp5ua.hyperhost.ua", "Port": "587"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1742c:$x1: $%SMTPDV$ 0x17442:$x2: $#TheHashHere%& 0x187cc:$x3: %FTPDV$ 0x18894:$x4: $%TelegramDv$ 0x14d3d:$x5: KeyLoggerEventArgs 0x150d3:$x5: KeyLoggerEventArgs 0x1883c:$m1: \| Snake Keylogger 0x188f4:$m1: \| Snake Keylogger 0x18a48:$m1: \| Snake Keylogger 0x18b6e:$m1: \| Snake Keylogger 0x18cc8:$m1: \| Snake Keylogger 0x187f0:$m2: Clipboard Logs ID 0x189fe:$m2: Screenshot Logs ID 0x18b12:$m2: keystroke Logs ID 0x18cfe:$m3: SnakePW 0x189d6:$m4: \SnakeKeylogger\
00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13b6e:$a1: get_encryptedPassword 0x13e5a:$a2: get_encryptedUsername 0x1397a:$a3: get_timePasswordChanged 0x13a75:$a4: get_passwordField 0x13b84:$a5: set_encryptedPassword 0x15170:$a7: get_logins 0x150d3:$a10: KeyLoggerEventArgs 0x14d3d:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x39b5c:$x1: $%SMTPDV$ 0x14cd0c:$x1: $%SMTPDV$ 0x16c72c:$x1: $%SMTPDV$ 0x39b72:$x2: $#TheHashHere%& 0x14cd22:$x2: $#TheHashHere%& 0x16c742:$x2: $#TheHashHere%& 0x3aefc:$x3: %FTPDV$ 0x14e0ac:$x3: %FTPDV$ 0x16dacc:$x3: %FTPDV$ 0x3afc4:$x4: $%TelegramDv$ 0x14e174:$x4: $%TelegramDv$ 0x16db94:$x4: $%TelegramDv$ 0x3746d:$x5: KeyLoggerEventArgs 0x37803:$x5: KeyLoggerEventArgs 0x14a61d:$x5: KeyLoggerEventArgs 0x14a9b3:$x5: KeyLoggerEventArgs 0x16a03d:$x5: KeyLoggerEventArgs 0x16a3d3:$x5: KeyLoggerEventArgs 0x3af6c:$m1: \| Snake Keylogger 0x3b024:$m1: \| Snake Keylogger 0x3b178:$m1: \| Snake Keylogger
00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3629e:$a1: get_encryptedPassword 0x14944e:$a1: get_encryptedPassword 0x168e6e:$a1: get_encryptedPassword 0x3658a:$a2: get_encryptedUsername 0x14973a:$a2: get_encryptedUsername 0x16915a:$a2: get_encryptedUsername 0x360aa:$a3: get_timePasswordChanged 0x14925a:$a3: get_timePasswordChanged 0x168c7a:$a3: get_timePasswordChanged 0x361a5:$a4: get_passwordField 0x149355:$a4: get_passwordField 0x168d75:$a4: get_passwordField 0x362b4:$a5: set_encryptedPassword 0x149464:$a5: set_encryptedPassword 0x168e84:$a5: set_encryptedPassword 0x378a0:$a7: get_logins 0x14aa50:$a7: get_logins 0x16a470:$a7: get_logins 0x37803:$a10: KeyLoggerEventArgs 0x14a9b3:$a10: KeyLoggerEventArgs 0x16a3d3:$a10: KeyLoggerEventArgs
Process Memory Space: l9qmoY93Ed.exe PID: 5956	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: l9qmoY93Ed.exe PID: 5956	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: l9qmoY93Ed.exe PID: 5956	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: l9qmoY93Ed.exe PID: 5956	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: l9qmoY93Ed.exe PID: 5956	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5b7e6:$x5: KeyLoggerEventArgs 0x5bb7c:$x5: KeyLoggerEventArgs 0x5c4b2:$x5: KeyLoggerEventArgs 0x5c813:$x5: KeyLoggerEventArgs 0x5dd00:$m1: \| Snake Keylogger 0x5dd58:$m1: \| Snake Keylogger 0x5ddec:$m1: \| Snake Keylogger 0x5de4d:$m1: \| Snake Keylogger 0x5dec2:$m1: \| Snake Keylogger 0x5dcd9:$m2: Clipboard Logs ID 0x5ddc7:$m2: Screenshot Logs ID 0x5de1f:$m2: keystroke Logs ID 0x5dedd:$m3: SnakePW 0x5ddb3:$m4: \SnakeKeylogger\
Process Memory Space: l9qmoY93Ed.exe PID: 5956	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x597f8:$a1: get_encryptedPassword 0x59ada:$a2: get_encryptedUsername 0x5960e:$a3: get_timePasswordChanged 0x59709:$a4: get_passwordField 0x5980e:$a5: set_encryptedPassword 0x5bc19:$a7: get_logins 0x5bb7c:$a10: KeyLoggerEventArgs 0x5b7e6:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: l9qmoY93Ed.exe PID: 4460	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: l9qmoY93Ed.exe PID: 4460	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: l9qmoY93Ed.exe PID: 4460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: l9qmoY93Ed.exe PID: 4460	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1b33f:$x5: KeyLoggerEventArgs 0x1b6d5:$x5: KeyLoggerEventArgs 0x1c00b:$x5: KeyLoggerEventArgs 0x1c36c:$x5: KeyLoggerEventArgs 0x1d859:$m1: \| Snake Keylogger 0x1d8b1:$m1: \| Snake Keylogger 0x1d945:$m1: \| Snake Keylogger 0x1d9a6:$m1: \| Snake Keylogger 0x1da1b:$m1: \| Snake Keylogger 0x1d832:$m2: Clipboard Logs ID 0x1d920:$m2: Screenshot Logs ID 0x1d978:$m2: keystroke Logs ID 0x1da36:$m3: SnakePW 0x1d90c:$m4: \SnakeKeylogger\
Process Memory Space: l9qmoY93Ed.exe PID: 4460	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x19351:$a1: get_encryptedPassword 0x19633:$a2: get_encryptedUsername 0x19167:$a3: get_timePasswordChanged 0x19262:$a4: get_passwordField 0x19367:$a5: set_encryptedPassword 0x1b772:$a7: get_logins 0x1b6d5:$a10: KeyLoggerEventArgs 0x1b33f:$a11: KeyLoggerEventArgsEventHandler
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.l9qmoY93Ed.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b362:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a54b:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a992:$a4: \Orbitum\User Data\Default\Login Data 0x1bb13:$a5: \Kometa\User Data\Default\Login Data
2.0.l9qmoY93Ed.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.0.l9qmoY93Ed.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.0.l9qmoY93Ed.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.0.l9qmoY93Ed.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.0.l9qmoY93Ed.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x148ca:$s1: UnHook 0x148d1:$s2: SetHook 0x148d9:$s3: CallNextHook 0x148e6:$s4: _hook
2.0.l9qmoY93Ed.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1762c:$x1: $%SMTPDV$ 0x17642:$x2: $#TheHashHere%& 0x189cc:$x3: %FTPDV$ 0x18a94:$x4: $%TelegramDv$ 0x14f3d:$x5: KeyLoggerEventArgs 0x152d3:$x5: KeyLoggerEventArgs 0x18a3c:$m1: \| Snake Keylogger 0x18af4:$m1: \| Snake Keylogger 0x18c48:$m1: \| Snake Keylogger 0x18d6e:$m1: \| Snake Keylogger 0x18ec8:$m1: \| Snake Keylogger 0x189f0:$m2: Clipboard Logs ID 0x18bfe:$m2: Screenshot Logs ID 0x18d12:$m2: keystroke Logs ID 0x18efe:$m3: SnakePW 0x18bd6:$m4: \SnakeKeylogger\
2.0.l9qmoY93Ed.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13d6e:$a1: get_encryptedPassword 0x1405a:$a2: get_encryptedUsername 0x13b7a:$a3: get_timePasswordChanged 0x13c75:$a4: get_passwordField 0x13d84:$a5: set_encryptedPassword 0x15370:$a7: get_logins 0x152d3:$a10: KeyLoggerEventArgs 0x14f3d:$a11: KeyLoggerEventArgsEventHandler
0.2.l9qmoY93Ed.exe.3a16530.8.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x19562:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1874b:$a3: \Google\Chrome\User Data\Default\Login Data 0x18b92:$a4: \Orbitum\User Data\Default\Login Data 0x19d13:$a5: \Kometa\User Data\Default\Login Data
0.2.l9qmoY93Ed.exe.3a16530.8.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.l9qmoY93Ed.exe.3a16530.8.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.l9qmoY93Ed.exe.3a16530.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.l9qmoY93Ed.exe.3a16530.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x12aca:$s1: UnHook 0x12ad1:$s2: SetHook 0x12ad9:$s3: CallNextHook 0x12ae6:$s4: _hook
0.2.l9qmoY93Ed.exe.3a16530.8.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1582c:$x1: $%SMTPDV$ 0x15842:$x2: $#TheHashHere%& 0x16bcc:$x3: %FTPDV$ 0x16c94:$x4: $%TelegramDv$ 0x1313d:$x5: KeyLoggerEventArgs 0x134d3:$x5: KeyLoggerEventArgs 0x16c3c:$m1: \| Snake Keylogger 0x16cf4:$m1: \| Snake Keylogger 0x16e48:$m1: \| Snake Keylogger 0x16f6e:$m1: \| Snake Keylogger 0x170c8:$m1: \| Snake Keylogger 0x16bf0:$m2: Clipboard Logs ID 0x16dfe:$m2: Screenshot Logs ID 0x16f12:$m2: keystroke Logs ID 0x170fe:$m3: SnakePW 0x16dd6:$m4: \SnakeKeylogger\
0.2.l9qmoY93Ed.exe.3a16530.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x11f6e:$a1: get_encryptedPassword 0x1225a:$a2: get_encryptedUsername 0x11d7a:$a3: get_timePasswordChanged 0x11e75:$a4: get_passwordField 0x11f84:$a5: set_encryptedPassword 0x13570:$a7: get_logins 0x134d3:$a10: KeyLoggerEventArgs 0x1313d:$a11: KeyLoggerEventArgsEventHandler
0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x94582:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xb3fa2:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x9376b:$a3: \Google\Chrome\User Data\Default\Login Data 0xb318b:$a3: \Google\Chrome\User Data\Default\Login Data 0x93bb2:$a4: \Orbitum\User Data\Default\Login Data 0xb35d2:$a4: \Orbitum\User Data\Default\Login Data 0x94d33:$a5: \Kometa\User Data\Default\Login Data 0xb4753:$a5: \Kometa\User Data\Default\Login Data
0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x8daea:$s1: UnHook 0xad50a:$s1: UnHook 0x8daf1:$s2: SetHook 0xad511:$s2: SetHook 0x8daf9:$s3: CallNextHook 0xad519:$s3: CallNextHook 0x8db06:$s4: _hook 0xad526:$s4: _hook
0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x9084c:$x1: $%SMTPDV$ 0xb026c:$x1: $%SMTPDV$ 0x90862:$x2: $#TheHashHere%& 0xb0282:$x2: $#TheHashHere%& 0x91bec:$x3: %FTPDV$ 0xb160c:$x3: %FTPDV$ 0x91cb4:$x4: $%TelegramDv$ 0xb16d4:$x4: $%TelegramDv$ 0x8e15d:$x5: KeyLoggerEventArgs 0x8e4f3:$x5: KeyLoggerEventArgs 0xadb7d:$x5: KeyLoggerEventArgs 0xadf13:$x5: KeyLoggerEventArgs 0x91c5c:$m1: \| Snake Keylogger 0x91d14:$m1: \| Snake Keylogger 0x91e68:$m1: \| Snake Keylogger 0x91f8e:$m1: \| Snake Keylogger 0x920e8:$m1: \| Snake Keylogger 0xb167c:$m1: \| Snake Keylogger 0xb1734:$m1: \| Snake Keylogger 0xb1888:$m1: \| Snake Keylogger 0xb19ae:$m1: \| Snake Keylogger
0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x8cf8e:$a1: get_encryptedPassword 0xac9ae:$a1: get_encryptedPassword 0x8d27a:$a2: get_encryptedUsername 0xacc9a:$a2: get_encryptedUsername 0x8cd9a:$a3: get_timePasswordChanged 0xac7ba:$a3: get_timePasswordChanged 0x8ce95:$a4: get_passwordField 0xac8b5:$a4: get_passwordField 0x8cfa4:$a5: set_encryptedPassword 0xac9c4:$a5: set_encryptedPassword 0x8e590:$a7: get_logins 0xadfb0:$a7: get_logins 0x8e4f3:$a10: KeyLoggerEventArgs 0xadf13:$a10: KeyLoggerEventArgs 0x8e15d:$a11: KeyLoggerEventArgsEventHandler 0xadb7d:$a11: KeyLoggerEventArgsEventHandler
0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x362ea:$s1: UnHook 0x14949a:$s1: UnHook 0x168eba:$s1: UnHook 0x362f1:$s2: SetHook 0x1494a1:$s2: SetHook 0x168ec1:$s2: SetHook 0x362f9:$s3: CallNextHook 0x1494a9:$s3: CallNextHook 0x168ec9:$s3: CallNextHook 0x36306:$s4: _hook 0x1494b6:$s4: _hook 0x168ed6:$s4: _hook
0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x3904c:$x1: $%SMTPDV$ 0x14c1fc:$x1: $%SMTPDV$ 0x16bc1c:$x1: $%SMTPDV$ 0x39062:$x2: $#TheHashHere%& 0x14c212:$x2: $#TheHashHere%& 0x16bc32:$x2: $#TheHashHere%& 0x3a3ec:$x3: %FTPDV$ 0x14d59c:$x3: %FTPDV$ 0x16cfbc:$x3: %FTPDV$ 0x3a4b4:$x4: $%TelegramDv$ 0x14d664:$x4: $%TelegramDv$ 0x16d084:$x4: $%TelegramDv$ 0x3695d:$x5: KeyLoggerEventArgs 0x36cf3:$x5: KeyLoggerEventArgs 0x149b0d:$x5: KeyLoggerEventArgs 0x149ea3:$x5: KeyLoggerEventArgs 0x16952d:$x5: KeyLoggerEventArgs 0x1698c3:$x5: KeyLoggerEventArgs 0x3a45c:$m1: \| Snake Keylogger 0x3a514:$m1: \| Snake Keylogger 0x3a668:$m1: \| Snake Keylogger
0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3578e:$a1: get_encryptedPassword 0x14893e:$a1: get_encryptedPassword 0x16835e:$a1: get_encryptedPassword 0x35a7a:$a2: get_encryptedUsername 0x148c2a:$a2: get_encryptedUsername 0x16864a:$a2: get_encryptedUsername 0x3559a:$a3: get_timePasswordChanged 0x14874a:$a3: get_timePasswordChanged 0x16816a:$a3: get_timePasswordChanged 0x35695:$a4: get_passwordField 0x148845:$a4: get_passwordField 0x168265:$a4: get_passwordField 0x357a4:$a5: set_encryptedPassword 0x148954:$a5: set_encryptedPassword 0x168374:$a5: set_encryptedPassword 0x36d90:$a7: get_logins 0x149f40:$a7: get_logins 0x169960:$a7: get_logins 0x36cf3:$a10: KeyLoggerEventArgs 0x149ea3:$a10: KeyLoggerEventArgs 0x1698c3:$a10: KeyLoggerEventArgs
0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x148ca:$s1: UnHook 0x127a7a:$s1: UnHook 0x14749a:$s1: UnHook 0x148d1:$s2: SetHook 0x127a81:$s2: SetHook 0x1474a1:$s2: SetHook 0x148d9:$s3: CallNextHook 0x127a89:$s3: CallNextHook 0x1474a9:$s3: CallNextHook 0x148e6:$s4: _hook 0x127a96:$s4: _hook 0x1474b6:$s4: _hook
0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1762c:$x1: $%SMTPDV$ 0x12a7dc:$x1: $%SMTPDV$ 0x14a1fc:$x1: $%SMTPDV$ 0x17642:$x2: $#TheHashHere%& 0x12a7f2:$x2: $#TheHashHere%& 0x14a212:$x2: $#TheHashHere%& 0x189cc:$x3: %FTPDV$ 0x12bb7c:$x3: %FTPDV$ 0x14b59c:$x3: %FTPDV$ 0x18a94:$x4: $%TelegramDv$ 0x12bc44:$x4: $%TelegramDv$ 0x14b664:$x4: $%TelegramDv$ 0x14f3d:$x5: KeyLoggerEventArgs 0x152d3:$x5: KeyLoggerEventArgs 0x1280ed:$x5: KeyLoggerEventArgs 0x128483:$x5: KeyLoggerEventArgs 0x147b0d:$x5: KeyLoggerEventArgs 0x147ea3:$x5: KeyLoggerEventArgs 0x18a3c:$m1: \| Snake Keylogger 0x18af4:$m1: \| Snake Keylogger 0x18c48:$m1: \| Snake Keylogger
0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13d6e:$a1: get_encryptedPassword 0x126f1e:$a1: get_encryptedPassword 0x14693e:$a1: get_encryptedPassword 0x1405a:$a2: get_encryptedUsername 0x12720a:$a2: get_encryptedUsername 0x146c2a:$a2: get_encryptedUsername 0x13b7a:$a3: get_timePasswordChanged 0x126d2a:$a3: get_timePasswordChanged 0x14674a:$a3: get_timePasswordChanged 0x13c75:$a4: get_passwordField 0x126e25:$a4: get_passwordField 0x146845:$a4: get_passwordField 0x13d84:$a5: set_encryptedPassword 0x126f34:$a5: set_encryptedPassword 0x146954:$a5: set_encryptedPassword 0x15370:$a7: get_logins 0x128520:$a7: get_logins 0x147f40:$a7: get_logins 0x152d3:$a10: KeyLoggerEventArgs 0x128483:$a10: KeyLoggerEventArgs 0x147ea3:$a10: KeyLoggerEventArgs
Click to see the 32 entries

Snort Signatures

ETPRO TROJAN 404/Snake/Matiex Keylogger Style External IP Check - Source IP: 192.168.2.5 - Destination IP: 132.226.8.169

Timestamp:	192.168.2.5132.226.8.16949699802842536 09/23/22-08:12:18.468779
SID:	2842536
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: l9qmoY93Ed.exe	ReversingLabs: Detection: 57%
Source: l9qmoY93Ed.exe	Virustotal: Detection: 32%			Perma Link

Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack

Avira: Label: TR/ATRAPS.Gen

Source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "yugolog@gthltd.buzz", "Password": "7213575aceACE@#$", "Host": "cp5ua.hyperhost.ua", "Port": "587"}

Source: l9qmoY93Ed.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: l9qmoY93Ed.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016B63D1h	2_2_016B6111
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016B7507h	2_2_016B7196
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016BFDE9h	2_2_016BFB30
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016B7DC7h	2_2_016B7B08
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016B8687h	2_2_016B83C9
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016BF539h	2_2_016BF280
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016B5F70h	2_2_016B5587
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016B8227h	2_2_016B7F68
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016BEC8Ah	2_2_016BE758
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016BF0E1h	2_2_016BEE28
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016B6B10h	2_2_016B66F8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016BF991h	2_2_016BF6D8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016B7967h	2_2_016B76A8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016B6B10h	2_2_016B6A3E
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_016B4AA8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 016B6B10h	2_2_016B66E8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06954D29h	2_2_06954A80
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 0695E529h	2_2_0695E280
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06958149h	2_2_06957EA0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06955181h	2_2_06954ED8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 0695E981h	2_2_0695E6D8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 069585A1h	2_2_069582F8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 0695E0A9h	2_2_0695DE00
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 069548D1h	2_2_06954628
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06957CF1h	2_2_06957A48
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06955A31h	2_2_06955788
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 0695F231h	2_2_0695EF88
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06955E89h	2_2_06955BE0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 0695F689h	2_2_0695F3E0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 069555D9h	2_2_06955330
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 0695EDD9h	2_2_0695EB30
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 069589F9h	2_2_06958750
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06956739h	2_2_06956490
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06953771h	2_2_069534C8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06956B91h	2_2_069568E8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 069562E1h	2_2_06956038
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 0695FAE1h	2_2_0695F838
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06953319h	2_2_06953070
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06957441h	2_2_06957198
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06954479h	2_2_069541D0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06957899h	2_2_069575F0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06953BC9h	2_2_06953920
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06956FE9h	2_2_06956D40
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then jmp 06954021h	2_2_06953D78
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_0695C336
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_0695C00F
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_0695C020

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2842536 ETPRO TROJAN 404/Snake/Matiex Keylogger Style External IP Check 192.168.2.5:49699 -> 132.226.8.169:80

May check the online IP address of the machine

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	DNS query: name: checkip.dyndns.org

Yara detected Generic Downloader

Source: Yara match	File source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

ASN Name: UTMEMUS UTMEMUS

Source: Joe Sandbox View

IP Address: 132.226.8.169 132.226.8.169

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: l9qmoY93Ed.exe, 00000002.00000002.561894079.00000000033A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: l9qmoY93Ed.exe, 00000002.00000002.561852057.0000000003396000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000002.00000002.561894079.00000000033A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: l9qmoY93Ed.exe, 00000002.00000002.561562050.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: l9qmoY93Ed.exe, 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: l9qmoY93Ed.exe, 00000002.00000002.561852057.0000000003396000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org4
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: l9qmoY93Ed.exe, 00000002.00000002.561562050.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: l9qmoY93Ed.exe, 00000000.00000003.314708775.0000000005708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.295803605.0000000005719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: l9qmoY93Ed.exe, 00000000.00000003.300236379.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.314708775.0000000005708000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300093885.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300033996.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300279098.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300201259.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300479313.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301285913.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301100656.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300304945.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300516891.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301332824.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301221727.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301189630.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300666113.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300439789.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301161542.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300401470.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300167619.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301126907.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: l9qmoY93Ed.exe, 00000000.00000003.300970999.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301100656.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301126907.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301036004.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: l9qmoY93Ed.exe, 00000000.00000003.300970999.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301100656.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301036004.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmll
Source: l9qmoY93Ed.exe, 00000000.00000003.300458982.0000000005714000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300479313.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300547173.0000000005714000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300639622.0000000005714000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300498619.0000000005714000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: l9qmoY93Ed.exe, 00000000.00000003.300516891.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300666113.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300565272.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF6
Source: l9qmoY93Ed.exe, 00000000.00000003.300236379.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300093885.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300279098.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300201259.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300304945.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300167619.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comQ
Source: l9qmoY93Ed.exe, 00000000.00000003.300516891.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300666113.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300889022.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300928525.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300565272.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comW.TTFZ
Source: l9qmoY93Ed.exe, 00000000.00000003.301285913.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301332824.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301221727.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301189630.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301161542.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301126907.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalsd
Source: l9qmoY93Ed.exe, 00000000.00000003.300479313.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300516891.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300666113.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300565272.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdu
Source: l9qmoY93Ed.exe, 00000000.00000003.300093885.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: l9qmoY93Ed.exe, 00000000.00000003.301531125.0000000005721000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301332824.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comitud
Source: l9qmoY93Ed.exe, 00000000.00000003.301648142.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301531125.0000000005721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comituo
Source: l9qmoY93Ed.exe, 00000000.00000003.300479313.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300516891.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300666113.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300565272.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comld
Source: l9qmoY93Ed.exe, 00000000.00000003.301285913.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301100656.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301332824.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301221727.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301189630.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301161542.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301126907.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comsiv
Source: l9qmoY93Ed.exe, 00000000.00000003.314708775.0000000005708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comttco
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.295119538.0000000005702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: l9qmoY93Ed.exe, 00000000.00000003.295119538.0000000005702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnn
Source: l9qmoY93Ed.exe, 00000000.00000003.295119538.0000000005702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnr
Source: l9qmoY93Ed.exe, 00000000.00000003.301970940.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: l9qmoY93Ed.exe, 00000000.00000003.301970940.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/u
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299297786.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299409033.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299635821.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299527509.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296535042.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297785759.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299179854.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298493164.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298293705.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298815241.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296510690.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298986768.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299739771.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/(
Source: l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296722937.0000000005720000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296874899.0000000005724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/6
Source: l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297785759.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298070835.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297869518.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/?
Source: l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296535042.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296510690.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296722937.0000000005720000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296874899.0000000005724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/X
Source: l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Z
Source: l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297785759.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298070835.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296722937.0000000005720000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296874899.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297869518.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/Z
Source: l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297785759.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298070835.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296874899.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297869518.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/u
Source: l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/liqu
Source: l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296722937.0000000005720000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296874899.0000000005724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/sv-s?
Source: l9qmoY93Ed.exe, 00000000.00000003.296535042.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296510690.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296722937.0000000005720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/u
Source: l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297785759.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298070835.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297869518.0000000005722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/~
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.292934561.0000000005723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: l9qmoY93Ed.exe, 00000000.00000003.297522887.0000000005713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com-s
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: l9qmoY93Ed.exe, 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: l9qmoY93Ed.exe, 00000000.00000002.315393634.0000000000B20000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: l9qmoY93Ed.exe PID: 5956, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: l9qmoY93Ed.exe PID: 5956, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: l9qmoY93Ed.exe PID: 4460, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: l9qmoY93Ed.exe PID: 4460, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: l9qmoY93Ed.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: l9qmoY93Ed.exe PID: 5956, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: l9qmoY93Ed.exe PID: 5956, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: l9qmoY93Ed.exe PID: 4460, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: l9qmoY93Ed.exe PID: 4460, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 0_2_00D4C174	0_2_00D4C174
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 0_2_00D4E778	0_2_00D4E778
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 0_2_00D4E76B	0_2_00D4E76B
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B6111	2_2_016B6111
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B7196	2_2_016B7196
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016BFB30	2_2_016BFB30
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B7B08	2_2_016B7B08
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B83C9	2_2_016B83C9
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B6B88	2_2_016B6B88
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016BF280	2_2_016BF280
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B5587	2_2_016B5587
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016BA45A	2_2_016BA45A
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B2C29	2_2_016B2C29
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B7F68	2_2_016B7F68
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016BE758	2_2_016BE758
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016BEE28	2_2_016BEE28
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016BF6D8	2_2_016BF6D8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B76A8	2_2_016B76A8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B6B78	2_2_016B6B78
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B4AA8	2_2_016B4AA8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016B4A98	2_2_016B4A98
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016BDFE0	2_2_016BDFE0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_016BDFD0	2_2_016BDFD0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06954A80	2_2_06954A80
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695E280	2_2_0695E280
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06957EA0	2_2_06957EA0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06954ED8	2_2_06954ED8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695E6D8	2_2_0695E6D8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_069582F8	2_2_069582F8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695DE00	2_2_0695DE00
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06954628	2_2_06954628
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06957A48	2_2_06957A48
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695C398	2_2_0695C398
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06955788	2_2_06955788
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695EF88	2_2_0695EF88
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06958BA8	2_2_06958BA8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06955BE0	2_2_06955BE0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695F3E0	2_2_0695F3E0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06955330	2_2_06955330
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695EB30	2_2_0695EB30
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06958750	2_2_06958750
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695B770	2_2_0695B770
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06956490	2_2_06956490
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695D098	2_2_0695D098
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_069534C8	2_2_069534C8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_069568E8	2_2_069568E8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06956038	2_2_06956038
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695F838	2_2_0695F838
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06950040	2_2_06950040
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06953070	2_2_06953070
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06957198	2_2_06957198
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_069541D0	2_2_069541D0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_069575F0	2_2_069575F0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06953920	2_2_06953920
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06956D40	2_2_06956D40
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06953D78	2_2_06953D78
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06957E90	2_2_06957E90
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695B6C9	2_2_0695B6C9
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06954EC8	2_2_06954EC8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695E6C8	2_2_0695E6C8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_069582E8	2_2_069582E8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06954619	2_2_06954619
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06957A3A	2_2_06957A3A
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695E271	2_2_0695E271
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06954A70	2_2_06954A70
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695F3D0	2_2_0695F3D0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06955BDA	2_2_06955BDA
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06955321	2_2_06955321
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695EB20	2_2_0695EB20
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06958741	2_2_06958741
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695EF79	2_2_0695EF79
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06955778	2_2_06955778
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06956482	2_2_06956482
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_069534B8	2_2_069534B8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_069568D8	2_2_069568D8
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695C00F	2_2_0695C00F
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695C020	2_2_0695C020
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06950028	2_2_06950028
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695F828	2_2_0695F828
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695602A	2_2_0695602A
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06953062	2_2_06953062
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06957188	2_2_06957188
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_069541C0	2_2_069541C0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_0695DDF0	2_2_0695DDF0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_069575E0	2_2_069575E0
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06953910	2_2_06953910
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06956D36	2_2_06956D36
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Code function: 2_2_06953D68	2_2_06953D68

Source: l9qmoY93Ed.exe, 00000000.00000002.317339858.00000000028CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebName.dll4 vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000000.00000002.315393634.0000000000B20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000000.00000002.316575659.0000000002811000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebName.dll4 vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameYFGGCVyufgtwfyuTGFWTVFAUYVF.exeX vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMetal.dllJ vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000000.00000002.332212556.0000000007060000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMetal.dllJ vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000000.00000000.289991126.0000000000530000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegUab.exeF vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000000.00000002.317300560.00000000028C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebName.dll4 vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameYFGGCVyufgtwfyuTGFWTVFAUYVF.exeX vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000000.00000002.325864527.0000000003811000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMetal.dllJ vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000002.00000002.560575264.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000002.00000000.312581315.0000000000422000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameYFGGCVyufgtwfyuTGFWTVFAUYVF.exeX vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe, 00000002.00000002.560030934.00000000011F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs l9qmoY93Ed.exe
Source: l9qmoY93Ed.exe	Binary or memory string: OriginalFilenamegUab.exeF vs l9qmoY93Ed.exe

Source: l9qmoY93Ed.exe	ReversingLabs: Detection: 57%
Source: l9qmoY93Ed.exe	Virustotal: Detection: 32%

Source: l9qmoY93Ed.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\l9qmoY93Ed.exe "C:\Users\user\Desktop\l9qmoY93Ed.exe"
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process created: C:\Users\user\Desktop\l9qmoY93Ed.exe C:\Users\user\Desktop\l9qmoY93Ed.exe
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process created: C:\Users\user\Desktop\l9qmoY93Ed.exe C:\Users\user\Desktop\l9qmoY93Ed.exe
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process created: C:\Users\user\Desktop\l9qmoY93Ed.exe C:\Users\user\Desktop\l9qmoY93Ed.exe	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process created: C:\Users\user\Desktop\l9qmoY93Ed.exe C:\Users\user\Desktop\l9qmoY93Ed.exe	Jump to behavior

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\l9qmoY93Ed.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@2/1

Source: l9qmoY93Ed.exe, 00000002.00000002.562272546.000000000437D000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000002.00000002.561952303.00000000033BE000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000002.00000002.562011210.00000000033CA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: l9qmoY93Ed.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, ??ufffd??/z?u0026??.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, u00ab???ufffd/u058fufffd???.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: l9qmoY93Ed.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: l9qmoY93Ed.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: l9qmoY93Ed.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

.NET source code contains potential unpacker

Source: l9qmoY93Ed.exe, order_management_system.cs	.Net Code: ResourceTemplateDefine System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.l9qmoY93Ed.exe.470000.0.unpack, order_management_system.cs	.Net Code: ResourceTemplateDefine System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

Code function: 2_2_016B8F09 push FFFFFF8Bh; iretd

2_2_016B8F0D

Source: l9qmoY93Ed.exe

Static PE information: 0x8F2DF49B [Tue Feb 13 16:53:47 2046 UTC]

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 5956, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: l9qmoY93Ed.exe, 00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: l9qmoY93Ed.exe, 00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe TID: 5952	Thread sleep time: -41226s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe TID: 5056	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Thread delayed: delay time: 41226			Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: l9qmoY93Ed.exe, 00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: l9qmoY93Ed.exe, 00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: l9qmoY93Ed.exe, 00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VIRTUALBOXDSOFTWARE\VMware, Inc.\VMware ToolsTSOFTWARE\Oracle\VirtualBox Guest Additions
Source: l9qmoY93Ed.exe, 00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE6HARDWARE\Description\System"SystemBiosVersionNSYSTEM\ControlSet001\Services\Disk\Enum
Source: l9qmoY93Ed.exe, 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000002.332212556.0000000007060000.00000004.08000000.00040000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000002.325864527.0000000003811000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: XKDFefinoUNVIucqeMu
Source: l9qmoY93Ed.exe, 00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: l9qmoY93Ed.exe, 00000002.00000002.560704618.0000000001705000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

Code function: 2_2_016B6B88 LdrInitializeThunk,

2_2_016B6B88

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, u00ab???ufffd/u058fufffd???.cs	Reference to suspicious API methods: ('?????', 'MapVirtualKey@user32.dll')
Source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, ?????/????ufffd.cs	Reference to suspicious API methods: ('?????', 'LoadLibrary@kernel32.dll'), ('?W???', 'GetProcAddress@kernel32')

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

Memory written: C:\Users\user\Desktop\l9qmoY93Ed.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process created: C:\Users\user\Desktop\l9qmoY93Ed.exe C:\Users\user\Desktop\l9qmoY93Ed.exe			Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Process created: C:\Users\user\Desktop\l9qmoY93Ed.exe C:\Users\user\Desktop\l9qmoY93Ed.exe			Jump to behavior

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Users\user\Desktop\l9qmoY93Ed.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Users\user\Desktop\l9qmoY93Ed.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 5956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 4460, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 5956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 4460, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\l9qmoY93Ed.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\l9qmoY93Ed.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Source: Yara match	File source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 5956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 4460, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 5956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 4460, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 2.0.l9qmoY93Ed.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3ab04c0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.39f4b10.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.l9qmoY93Ed.exe.3a16530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 5956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: l9qmoY93Ed.exe PID: 4460, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	Path Interception	111 Process Injection	1 Masquerading	2 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	2 Data from Local System	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
l9qmoY93Ed.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
l9qmoY93Ed.exe	32%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.0.l9qmoY93Ed.exe.400000.0.unpack	100%	Avira	TR/ATRAPS.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
checkip.dyndns.com	0%	Virustotal		Browse
checkip.dyndns.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.comsiv	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.comessed	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/~	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://checkip.dyndns.org4	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cnn	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/6	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://www.founder.com.cn/cnr	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/(	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/Z	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/sv-s?	0%	Avira URL Cloud	safe
http://www.fontbureau.comalsd	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Z	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/X	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.fontbureau.comQ	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/u	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/?	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/u	0%	URL Reputation	safe
http://www.fontbureau.comld	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.comitud	0%	URL Reputation	safe
http://www.fontbureau.comW.TTFZ	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/u	0%	Avira URL Cloud	safe
http://www.fontbureau.comdu	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/liqu	0%	Avira URL Cloud	safe
http://www.fontbureau.comF6	0%	Avira URL Cloud	safe
http://www.fontbureau.comituo	0%	Avira URL Cloud	safe
http://www.sakkal.com-s	0%	Avira URL Cloud	safe
http://www.fontbureau.comttco	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
checkip.dyndns.com	132.226.8.169	true	true	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	l9qmoY93Ed.exe, 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comsiv	l9qmoY93Ed.exe, 00000000.00000003.301285913.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301100656.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301332824.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301221727.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301189630.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301161542.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301126907.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comessed	l9qmoY93Ed.exe, 00000000.00000003.300093885.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/~	l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297785759.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298070835.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297869518.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.292934561.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org4	l9qmoY93Ed.exe, 00000002.00000002.561852057.0000000003396000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnn	l9qmoY93Ed.exe, 00000000.00000003.295119538.0000000005702000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comF6	l9qmoY93Ed.exe, 00000000.00000003.300516891.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300666113.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300565272.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/6	l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296722937.0000000005720000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296874899.0000000005724000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/sv-s?	l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296722937.0000000005720000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296874899.0000000005724000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/u	l9qmoY93Ed.exe, 00000000.00000003.301970940.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	l9qmoY93Ed.exe, 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnr	l9qmoY93Ed.exe, 00000000.00000003.295119538.0000000005702000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/liqu	l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html	l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/(	l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	l9qmoY93Ed.exe, 00000002.00000002.561894079.00000000033A3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	l9qmoY93Ed.exe, 00000002.00000002.561562050.0000000003301000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/Z	l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comalsd	l9qmoY93Ed.exe, 00000000.00000003.301285913.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301332824.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301221727.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301189630.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301161542.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301126907.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comdu	l9qmoY93Ed.exe, 00000000.00000003.300479313.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300516891.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300666113.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300565272.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Z	l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.295803605.0000000005719000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	l9qmoY93Ed.exe, 00000000.00000003.300236379.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.314708775.0000000005708000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300093885.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300033996.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300279098.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300201259.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300479313.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301285913.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301100656.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300304945.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300516891.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301332824.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301221727.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301189630.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300666113.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300439789.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301161542.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300401470.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300167619.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301126907.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/	l9qmoY93Ed.exe, 00000000.00000003.301970940.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmll	l9qmoY93Ed.exe, 00000000.00000003.300970999.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301100656.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301036004.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/X	l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296535042.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296510690.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296722937.0000000005720000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296874899.0000000005724000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.agfamonotype.	l9qmoY93Ed.exe, 00000000.00000003.314708775.0000000005708000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comQ	l9qmoY93Ed.exe, 00000000.00000003.300236379.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300093885.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300279098.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300201259.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300304945.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300167619.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comituo	l9qmoY93Ed.exe, 00000000.00000003.301648142.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301531125.0000000005721000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	l9qmoY93Ed.exe, 00000002.00000002.561852057.0000000003396000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000002.00000002.561894079.00000000033A3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/u	l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297785759.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298070835.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296874899.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297869518.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297785759.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298070835.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296722937.0000000005720000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296874899.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297869518.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comW.TTFZ	l9qmoY93Ed.exe, 00000000.00000003.300516891.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300666113.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300889022.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300928525.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300565272.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/?	l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297785759.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297235573.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298070835.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297142586.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297403640.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297869518.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com-s	l9qmoY93Ed.exe, 00000000.00000003.297522887.0000000005713000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.295119538.0000000005702000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	l9qmoY93Ed.exe, 00000000.00000003.300458982.0000000005714000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300479313.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300547173.0000000005714000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300639622.0000000005714000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300498619.0000000005714000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/u	l9qmoY93Ed.exe, 00000000.00000003.296535042.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296510690.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296722937.0000000005720000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.html	l9qmoY93Ed.exe, 00000000.00000003.300970999.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301100656.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301126907.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301036004.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comld	l9qmoY93Ed.exe, 00000000.00000003.300479313.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300516891.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300666113.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.300565272.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	l9qmoY93Ed.exe, 00000000.00000003.297560036.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299297786.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299409033.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299635821.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299527509.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296535042.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297785759.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299179854.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297376094.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298493164.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298293705.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297127049.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296983801.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297622066.0000000005722000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.297331514.0000000005718000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298815241.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296510690.0000000005724000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.298986768.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.299739771.0000000005723000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.296843045.0000000005722000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	l9qmoY93Ed.exe, 00000000.00000002.330594445.0000000006992000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comttco	l9qmoY93Ed.exe, 00000000.00000003.314708775.0000000005708000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comitud	l9qmoY93Ed.exe, 00000000.00000003.301531125.0000000005721000.00000004.00000800.00020000.00000000.sdmp, l9qmoY93Ed.exe, 00000000.00000003.301332824.0000000005723000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States		16989	UTMEMUS	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	708248
Start date and time:	2022-09-23 08:11:09 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	l9qmoY93Ed.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@2/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 101 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:12:08	API Interceptor	1x Sleep call for process: l9qmoY93Ed.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
132.226.8.169	21092022_receipt.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	New Order.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	KREDI.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	TI1021730205.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	vk2dtGkvDY.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	scan_invoice_21092022.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Swift.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	343795a.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	RFQ 6674 -21.9.2022.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	invoice.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	12220173387_20220825_13363111_Hesap0zeti.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	INQ-2022-09-21-AQI3N847211-INQ0290.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	pernyataan saat ini.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	payment Term.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	BC_613438_684665794.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	INGRID.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	DNcAYFiYDp.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	DHL airwaybill.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	22-391-002458.js	Get hash	malicious	Browse	checkip.dyndns.org/
	MV GNV CRISTAL.xll	Get hash	malicious	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
checkip.dyndns.com	22588SANZI.exe	Get hash	malicious	Browse	193.122.130.0
	Arrival_Percel No00929887355..exe	Get hash	malicious	Browse	193.122.6.168
	IMG-1300466.exe	Get hash	malicious	Browse	132.226.247.73
	Specifications_Details_RFQ.exe	Get hash	malicious	Browse	132.226.247.73
	INV012000.exe	Get hash	malicious	Browse	132.226.247.73
	Wtughrrlt.exe	Get hash	malicious	Browse	132.226.247.73
	rWLEI3BVkx.exe	Get hash	malicious	Browse	193.122.130.0
	qwOpaDGcHJ.exe	Get hash	malicious	Browse	193.122.6.168
	4b9SFahCuA.exe	Get hash	malicious	Browse	193.122.6.168
	specification.doc	Get hash	malicious	Browse	193.122.6.168
	Order#6875480.xlsx	Get hash	malicious	Browse	158.101.44.242
	49HDD3uFb8.exe	Get hash	malicious	Browse	158.101.44.242
	RFQ pdf.exe	Get hash	malicious	Browse	193.122.130.0
	BBVA-Confirming Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.vbs	Get hash	malicious	Browse	132.226.247.73
	Specifications_Details_30200_RFQ.exe	Get hash	malicious	Browse	158.101.44.242
	21092022_receipt.exe	Get hash	malicious	Browse	132.226.8.169
	New Order.exe	Get hash	malicious	Browse	132.226.8.169
	KREDI.exe	Get hash	malicious	Browse	132.226.8.169
	4nz1Kr0NLW.exe	Get hash	malicious	Browse	132.226.247.73
	JD22 SEPT0 7 Shipping documents.exe	Get hash	malicious	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UTMEMUS	IMG-1300466.exe	Get hash	malicious	Browse	132.226.247.73
	Specifications_Details_RFQ.exe	Get hash	malicious	Browse	132.226.247.73
	INV012000.exe	Get hash	malicious	Browse	132.226.247.73
	Wtughrrlt.exe	Get hash	malicious	Browse	132.226.247.73
	BBVA-Confirming Liquidaci#Ufffdn por Factorizaci#Ufffdn de Cr#Ufffdditos.vbs	Get hash	malicious	Browse	132.226.247.73
	21092022_receipt.exe	Get hash	malicious	Browse	132.226.8.169
	New Order.exe	Get hash	malicious	Browse	132.226.8.169
	KREDI.exe	Get hash	malicious	Browse	132.226.8.169
	4nz1Kr0NLW.exe	Get hash	malicious	Browse	132.226.247.73
	JD22 SEPT0 7 Shipping documents.exe	Get hash	malicious	Browse	132.226.247.73
	TI1021730205.exe	Get hash	malicious	Browse	132.226.8.169
	vk2dtGkvDY.exe	Get hash	malicious	Browse	132.226.8.169
	scan_invoice_21092022.exe	Get hash	malicious	Browse	132.226.8.169
	Swift.exe	Get hash	malicious	Browse	132.226.8.169
	343795a.exe	Get hash	malicious	Browse	132.226.8.169
	MV GNV CRISTAL_992002992020-NEW-22-10-2022_PDF.exe	Get hash	malicious	Browse	132.226.247.73
	IMG_20220921_0004.xlsx	Get hash	malicious	Browse	132.226.247.73
	0x000600000001da06-134.dat.exe	Get hash	malicious	Browse	132.226.247.73
	Factura.vbs	Get hash	malicious	Browse	132.226.247.73
	RFQ 6674 -21.9.2022.exe	Get hash	malicious	Browse	132.226.8.169

Process:	C:\Users\user\Desktop\l9qmoY93Ed.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.345811588615766
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
MD5:	2E016B886BDB8389D2DD0867BE55F87B
SHA1:	25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
SHA-256:	1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
SHA-512:	C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.754111708993234
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	l9qmoY93Ed.exe
File size:	793088
MD5:	fb561127230e7104e2df440f2712581e
SHA1:	62741306fbb863c7def4a3cc21175a3badf59f14
SHA256:	48929d6ac22fe9d2edee0e1ea483b143786d3b0965be5c771eb6a2d90018df21
SHA512:	69762dd766e01737a7adf88e415f6e912aa8ba6de3c8cb8592dc19430669074fa8b1c941747874d707990632ecd21de51da7a507695d0d407c4c03532403fbf3
SSDEEP:	12288:Hn+v8EgdeU9UgB8pAamPJ4+Y34kj3xAZ0XxfbVDfhxg:pEgYCU9pAama+0dO2VDfs
TLSH:	3DF4CF22D7AA4F4BD01162B89491C5B457AEEF05E02EC2476FEA7C9FF0767918221F13
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....-...............0......J......>.... ........@.. ....................................@................................

File Icon


Icon Hash:	ce9c9496e4949c9e

Static PE Info

General

Entrypoint:	0x4bec3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8F2DF49B [Tue Feb 13 16:53:47 2046 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbebec	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x4658	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xbebd0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbcc44	0xbce00	False	0.6627957478491066	data	6.7643112515498895	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x4658	0x4800	False	0.5441080729166666	data	6.17580418567749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc6000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xc00e8	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_GROUP_ICON	0xc4310	0x14	data
RT_VERSION	0xc4324	0x334	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5132.226.8.16949699802842536 09/23/22-08:12:18.468779	TCP	2842536	ETPRO TROJAN 404/Snake/Matiex Keylogger Style External IP Check	49699	80	192.168.2.5	132.226.8.169

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 23, 2022 08:12:17.439915895 CEST	49699	80	192.168.2.5	132.226.8.169
Sep 23, 2022 08:12:17.741672993 CEST	80	49699	132.226.8.169	192.168.2.5
Sep 23, 2022 08:12:17.741903067 CEST	49699	80	192.168.2.5	132.226.8.169
Sep 23, 2022 08:12:18.468779087 CEST	49699	80	192.168.2.5	132.226.8.169
Sep 23, 2022 08:12:18.766530991 CEST	80	49699	132.226.8.169	192.168.2.5
Sep 23, 2022 08:12:18.767304897 CEST	80	49699	132.226.8.169	192.168.2.5
Sep 23, 2022 08:12:18.829407930 CEST	49699	80	192.168.2.5	132.226.8.169
Sep 23, 2022 08:13:23.764321089 CEST	80	49699	132.226.8.169	192.168.2.5
Sep 23, 2022 08:13:23.764427900 CEST	49699	80	192.168.2.5	132.226.8.169
Sep 23, 2022 08:13:58.761035919 CEST	49699	80	192.168.2.5	132.226.8.169
Sep 23, 2022 08:13:59.056631088 CEST	80	49699	132.226.8.169	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 23, 2022 08:12:17.231950045 CEST	56894	53	192.168.2.5	8.8.8.8
Sep 23, 2022 08:12:17.252614021 CEST	53	56894	8.8.8.8	192.168.2.5
Sep 23, 2022 08:12:17.333827972 CEST	50295	53	192.168.2.5	8.8.8.8
Sep 23, 2022 08:12:17.357783079 CEST	53	50295	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 23, 2022 08:12:17.231950045 CEST	192.168.2.5	8.8.8.8	0xebd1	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 23, 2022 08:12:17.333827972 CEST	192.168.2.5	8.8.8.8	0x440	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 23, 2022 08:12:17.252614021 CEST	8.8.8.8	192.168.2.5	0xebd1	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2022 08:12:17.252614021 CEST	8.8.8.8	192.168.2.5	0xebd1	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 23, 2022 08:12:17.252614021 CEST	8.8.8.8	192.168.2.5	0xebd1	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 23, 2022 08:12:17.252614021 CEST	8.8.8.8	192.168.2.5	0xebd1	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 23, 2022 08:12:17.252614021 CEST	8.8.8.8	192.168.2.5	0xebd1	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 23, 2022 08:12:17.252614021 CEST	8.8.8.8	192.168.2.5	0xebd1	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 23, 2022 08:12:17.357783079 CEST	8.8.8.8	192.168.2.5	0x440	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2022 08:12:17.357783079 CEST	8.8.8.8	192.168.2.5	0x440	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 23, 2022 08:12:17.357783079 CEST	8.8.8.8	192.168.2.5	0x440	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 23, 2022 08:12:17.357783079 CEST	8.8.8.8	192.168.2.5	0x440	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 23, 2022 08:12:17.357783079 CEST	8.8.8.8	192.168.2.5	0x440	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 23, 2022 08:12:17.357783079 CEST	8.8.8.8	192.168.2.5	0x440	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49699	132.226.8.169	80	C:\Users\user\Desktop\l9qmoY93Ed.exe

Timestamp	kBytes transferred	Direction	Data
Sep 23, 2022 08:12:18.468779087 CEST	102	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 23, 2022 08:12:18.767304897 CEST	102	IN	HTTP/1.1 200 OK Date: Fri, 23 Sep 2022 06:12:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 34 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.43</body></html>

Target ID:	0
Start time:	08:12:00
Start date:	23/09/2022
Path:	C:\Users\user\Desktop\l9qmoY93Ed.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\l9qmoY93Ed.exe"
Imagebase:	0x470000
File size:	793088 bytes
MD5 hash:	FB561127230E7104E2DF440F2712581E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.316885128.000000000285F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.328169397.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	08:12:09
Start date:	23/09/2022
Path:	C:\Users\user\Desktop\l9qmoY93Ed.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\l9qmoY93Ed.exe
Imagebase:	0x100000
File size:	793088 bytes
MD5 hash:	FB561127230E7104E2DF440F2712581E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	08:12:10
Start date:	23/09/2022
Path:	C:\Users\user\Desktop\l9qmoY93Ed.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\l9qmoY93Ed.exe
Imagebase:	0xfa0000
File size:	793088 bytes
MD5 hash:	FB561127230E7104E2DF440F2712581E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000000.312260843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	96
Total number of Limit Nodes:	6

Executed Functions

Function 00D4B880 Relevance: 6.1, APIs: 4, Instructions: 126
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D4B8F0
GetCurrentThread.KERNEL32 ref: 00D4B92D
GetCurrentProcess.KERNEL32 ref: 00D4B96A
GetCurrentThreadId.KERNEL32 ref: 00D4B9C3

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1eb8623cf01404d34647275dabfe27a86a0052a1a047ce05d447dc6cbb5f3a14
Instruction ID: a14b7f2d97782e612a3c3614b09f12a4b62a04ce705b773315fa563cc8c66425
Opcode Fuzzy Hash: 1eb8623cf01404d34647275dabfe27a86a0052a1a047ce05d447dc6cbb5f3a14
Instruction Fuzzy Hash: B75177B49016488FDB10CFAAC548BEEBBF0EF48314F24845AE059A7351C7749989CF62

Uniqueness

Uniqueness Score: -1.00%

Function 00D4B890 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D4B8F0
GetCurrentThread.KERNEL32 ref: 00D4B92D
GetCurrentProcess.KERNEL32 ref: 00D4B96A
GetCurrentThreadId.KERNEL32 ref: 00D4B9C3

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7ee0e0bbd764cbd1613c16b1e4b983e7170821876a85a3d8859fc5c854529ac9
Instruction ID: 95245a47d498234323c61056b4f4eab3efe70aba1db78900bbb47cbaa559ec42
Opcode Fuzzy Hash: 7ee0e0bbd764cbd1613c16b1e4b983e7170821876a85a3d8859fc5c854529ac9
Instruction Fuzzy Hash: EE5167B4D016488FDB10CFAAC648BDEBBF0EF48314F24845AE459A7750C774A988CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00D495A8 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D497EE

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 03359ca30e547f419c06468d35f21421c9390acf0cb128e5eb999aab8a7032af
Instruction ID: 43765068ff809d2e8814ab861711e541c5ff3bf9c230ecd74b73ad745b0a6bec
Opcode Fuzzy Hash: 03359ca30e547f419c06468d35f21421c9390acf0cb128e5eb999aab8a7032af
Instruction Fuzzy Hash: 50710370A00B058FDB24DF2AD55169BB7F1FF88314F048A29D48AD7A40DB75E8498FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D45364 Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c204f9dd992918222f8277b25f1c0541405e2af1c251a425fdcdc4fa82ef9e02
Instruction ID: add2c74216e64be7b4d3dcb9a6394a4e2d5c0b951fe05725a47db586045c0dd2
Opcode Fuzzy Hash: c204f9dd992918222f8277b25f1c0541405e2af1c251a425fdcdc4fa82ef9e02
Instruction Fuzzy Hash: 4E4115B1C00618CFDB20CFA9D8447DEBBB5BF48304F248069D408AB355DB75698ACFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D43CAC Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D45421

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: df4256deeb174836cceb32f02c7f8f85299b202cce9f8e51d08d7407390b9742
Instruction ID: f30d63a6acee6a2d5119706afeb85a3cbe508d299c8ff00169b38f7e64b0b1ff
Opcode Fuzzy Hash: df4256deeb174836cceb32f02c7f8f85299b202cce9f8e51d08d7407390b9742
Instruction Fuzzy Hash: DF41E3B1C00619CFDB24CFA9D8447DEBBB5BF48308F248069D419AB255DB756989CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D4BAB0 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D4BB3F

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b3b5956fe3e137725c781ddd8fab29f904a016988357aade7a2b8016b871be78
Instruction ID: 9e37a913c59e97fbe1ada5c58392aa86617c22eb4179411c69a86c34263c0b47
Opcode Fuzzy Hash: b3b5956fe3e137725c781ddd8fab29f904a016988357aade7a2b8016b871be78
Instruction Fuzzy Hash: A421E3B59002089FDB10CFA9D985BEEBBF8FB58324F14801AE954A3310D374A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4BAB8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D4BB3F

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e4e6008a9c669041bc6f9c032c1fd9d4b42c622c8bee0bad53ea7cbcd0cf0599
Instruction ID: 895f6420fb54e34af329667facf94cbaddba458aac95c9473abeac81732d5668
Opcode Fuzzy Hash: e4e6008a9c669041bc6f9c032c1fd9d4b42c622c8bee0bad53ea7cbcd0cf0599
Instruction Fuzzy Hash: B121C2B59002499FDB10CFAAD984BDEBBF8FB48324F14841AE954A3710D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D49A08 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00D49869,00000800,00000000,00000000), ref: 00D49A7A

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b094c157d26a1b6651104474625cae1ef32ef765c76f8c480032295964a71c85
Instruction ID: d68b71d939fa88ce053a0b85de326776c1662ebdb90f31f3a825c8b696982212
Opcode Fuzzy Hash: b094c157d26a1b6651104474625cae1ef32ef765c76f8c480032295964a71c85
Instruction Fuzzy Hash: 222138B69002098FCB10CF9AD845BDFFBF4EB88324F14852AD519A7710C375A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D48900 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00D49869,00000800,00000000,00000000), ref: 00D49A7A

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 097d53354fd00479ebf2e024a88dc04edbb0be2ff78d95f622160cb4533197c6
Instruction ID: 503a9e6de85b6cebf7e9a807434bef439822d232284c33367dad5d5ab0d39a44
Opcode Fuzzy Hash: 097d53354fd00479ebf2e024a88dc04edbb0be2ff78d95f622160cb4533197c6
Instruction Fuzzy Hash: 3111E4B69002499FCB10CF9AD445BDFFBF4EB48324F14842AE559A7700C3B5A949CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D49788 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D497EE

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 567c56d4110bf1b90f3beb93dceb5cdf615edaf43d326be7d43f380ecdf9ca51
Instruction ID: fa544c3c49e8c6fe94ca9313775c48ca578b1c0569c03a3d5e261c2567a90010
Opcode Fuzzy Hash: 567c56d4110bf1b90f3beb93dceb5cdf615edaf43d326be7d43f380ecdf9ca51
Instruction Fuzzy Hash: E911D2B6C006498FCB10CF9AD444BDFFBF4AB48324F14851AD869A7700D374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AED3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315229530.0000000000AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aed000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ef5c7bf23efc5bca04743fca2c421c11aad6b5097e5941f0d170533dd10008
Instruction ID: 173ca10f17ae686fc57876bd01109168ed1df47a8cd59ba44be1dae739eab39a
Opcode Fuzzy Hash: 05ef5c7bf23efc5bca04743fca2c421c11aad6b5097e5941f0d170533dd10008
Instruction Fuzzy Hash: 29214975504284DFDB01CF15D9C0B1ABBB5FBA8324F24C569E8090F786C336E85ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315267051.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_afd000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed03acf0719afe9119689e37552580db37909d5bb91af2407327aa4b566a415
Instruction ID: ec4d8da6e9d9c79c021a38ea8f80cc8a8b13b54ad542c41a83d25572192fb16e
Opcode Fuzzy Hash: 8ed03acf0719afe9119689e37552580db37909d5bb91af2407327aa4b566a415
Instruction Fuzzy Hash: CD213771504248DFCB16CF54D9C0B26BB62FB84314F24C969E90A4B746CB36D84BCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315267051.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_afd000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46658a7110bf34b6315f0fa9d349912e4ae1bf61e22e937ca96ea382a7c57a6f
Instruction ID: f0f1c98f92628d0259cd9d8dac60432d459e4b37d909fcd06aaab0599702aa61
Opcode Fuzzy Hash: 46658a7110bf34b6315f0fa9d349912e4ae1bf61e22e937ca96ea382a7c57a6f
Instruction Fuzzy Hash: DE210771504248EFDB02CF54D9C0B66BB66FB84314F24C969E9094B745C336D84ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315267051.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_afd000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb635e49a608a7277ea24e55c4d92b5f2adedf3eebad02ddc072417a6045c9da
Instruction ID: 5c4e004b2c7c452d38b1c7f21413e59f26c504177b6235b06732dd624f769ccb
Opcode Fuzzy Hash: fb635e49a608a7277ea24e55c4d92b5f2adedf3eebad02ddc072417a6045c9da
Instruction Fuzzy Hash: 662192755093C48FCB03CF20D990715BF71EB46314F28C5EAD9498B657C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00AED3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315229530.0000000000AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aed000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5e0b608e762b73065f3240f20cc597103337480dfea35710c9739bf98176558
Instruction ID: a6ea3e0a42d98d67548ef3895543791769d38e12f4b65e109cbd3a0174a1ff76
Opcode Fuzzy Hash: a5e0b608e762b73065f3240f20cc597103337480dfea35710c9739bf98176558
Instruction Fuzzy Hash: 90110876404280DFCF11CF10D5C4B1ABF71FB94324F24C6A9D8090B656C33AE856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315267051.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_afd000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd63c1716a40d01d4b9c8176ae75a0eba7f53514f489a0ee23e72f30f1191b10
Instruction ID: cde5757e5eacdb44c0da49f15fadbaa2b59615f06f34f696ccad3bfdab764c01
Opcode Fuzzy Hash: bd63c1716a40d01d4b9c8176ae75a0eba7f53514f489a0ee23e72f30f1191b10
Instruction Fuzzy Hash: B711D075504284DFCB02CF50C5C0B65FB72FB84314F24C6AEE9494B656C33AD84ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AED745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315229530.0000000000AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aed000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb542525030d149741ba59709c3f41f0c0640d2ae1ec6d518316a9274b1549ec
Instruction ID: f2b5aee2b4126fb0cf91f7d630c4bf9875b716eae02dd372cae3f20f41cfbbdb
Opcode Fuzzy Hash: cb542525030d149741ba59709c3f41f0c0640d2ae1ec6d518316a9274b1549ec
Instruction Fuzzy Hash: 6701F2714043C49EE7205F22DD84BA6BBA8EF41368F18852AED151A642D3789888CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00AED744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315229530.0000000000AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aed000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1275001482bf158f14fad01a38a81aad17b3a753fb3a4eb6477dd55081ad6297
Instruction ID: 6c70ff299188a6c8550b09cc44d40325df0424b35cea07798ad0dc0e8a59269f
Opcode Fuzzy Hash: 1275001482bf158f14fad01a38a81aad17b3a753fb3a4eb6477dd55081ad6297
Instruction Fuzzy Hash: EDF062714042849EEB109F16DCC4B66FB98EB45734F18C45AED085B686C3799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D4E778 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc1da57495fb0ec8281f1666e05c33feb4bccfb4cd7b3f00e86802dabe8a87d
Instruction ID: f8d4416b5d5bf5c128f54d182d73b364ae170bf56673a96fa4a2fc4f711c11b2
Opcode Fuzzy Hash: abc1da57495fb0ec8281f1666e05c33feb4bccfb4cd7b3f00e86802dabe8a87d
Instruction Fuzzy Hash: 5512A0B1411F46CAE710DF65FC983897BA0B745328F904308D261ABBF9D7B8214ACF68

Uniqueness

Uniqueness Score: -1.00%

Function 00D4C174 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82666b64fc12a124822f6295dffd99653bfea1534e88cd6deef4a5892758f84
Instruction ID: 5a83671069ef048c361fa463931b7e2ae848ec9d4174838dc32155f002c48a51
Opcode Fuzzy Hash: a82666b64fc12a124822f6295dffd99653bfea1534e88cd6deef4a5892758f84
Instruction Fuzzy Hash: 07A16C32E10619CFCF15DFB5D8845DEBBB2FF85300B15856AE806AB261EB71A905CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D4E76B Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315849493.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fc0285b6aaedd573e5b67dc49fa1462b02e16d1e49285c67d3aad4b64ea6cd
Instruction ID: 74b1960ae4887eaebb3a227a8804eaaa49a73c7bc2d91646b8971856097f3566
Opcode Fuzzy Hash: 96fc0285b6aaedd573e5b67dc49fa1462b02e16d1e49285c67d3aad4b64ea6cd
Instruction Fuzzy Hash: 6FC1E3B1811B46CAD711DF65FC883897BB1BB85328F504308D161BB7E9D7B8258ACFA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: l9qmoY93Ed.exePID: 4460, Parent PID: 5956COMMON

Execution Graph

Execution Coverage:	18.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	41.5%
Total number of Nodes:	340
Total number of Limit Nodes:	58

Executed Functions

Function 016B5587 Relevance: 2.1, APIs: 1, Instructions: 633
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 016B5635

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7301d64773ccedbedc0fa36e63968571f7e97408c0389f271c8072eda3a0447c
Instruction ID: 912ab00e16cbd1e3d19fe06abd86400c2c68494d6e55a068f4dad6e8a79a4789
Opcode Fuzzy Hash: 7301d64773ccedbedc0fa36e63968571f7e97408c0389f271c8072eda3a0447c
Instruction Fuzzy Hash: B1629EB4D002688FDB64DF69C894BEDBBB2BB49304F1482AAD409A7355DB349EC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016B83C9 Relevance: 1.8, APIs: 1, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 016B855B

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 71cb585f75504f1bdc5a6fd4d0694db508348c04107dbdaf8275bd185cba0373
Instruction ID: 818a56127430dd04a6dfe4f124913fd2a9656c9b5ee42b6e252b9cad50f6f4f0
Opcode Fuzzy Hash: 71cb585f75504f1bdc5a6fd4d0694db508348c04107dbdaf8275bd185cba0373
Instruction Fuzzy Hash: 10D1C174E01218CFDB24DFA5D994BADBBB6FB88304F2081AAD809A7355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016B6111 Relevance: 1.8, APIs: 1, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 016B61EC

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 41b34344ade82ffa953446d110188c5999d93c061cec7dc4b4d3b690ede4ab2a
Instruction ID: 5cd1123cfd85709c036cc7732c10e09c0f72955979ade50efc7cdbedead7a6b2
Opcode Fuzzy Hash: 41b34344ade82ffa953446d110188c5999d93c061cec7dc4b4d3b690ede4ab2a
Instruction Fuzzy Hash: D3D1A274E01218CFDB24DFA5D994BADBBB2FB89304F2081AAD409A7355DB349E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06956490 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695655B

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e1e47917bdc42878ed14cd4dfb0b46be687b89b31397611369cc3ec4a5c6dc44
Instruction ID: 491283f8343e3090f38cac59fc6183ae418668609e2a1c400b685725c0a233a8
Opcode Fuzzy Hash: e1e47917bdc42878ed14cd4dfb0b46be687b89b31397611369cc3ec4a5c6dc44
Instruction Fuzzy Hash: 2EC1A174E01218CFDB64DFA5D954BADBBB2BB89304F2081A9D809AB354DB359E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06954A80 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 06954B4B

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: faea04a3dd1e1848b2638b3fa7e5ec0c60b707089c11cb0ffc6aaab54f17e58e
Instruction ID: 4b2f3551da31fc4344e9357e1621e62fa7b42cc6910058555d44a2df623301e3
Opcode Fuzzy Hash: faea04a3dd1e1848b2638b3fa7e5ec0c60b707089c11cb0ffc6aaab54f17e58e
Instruction Fuzzy Hash: 6AC19274E00218CFDB64DFA5D954BADBBB2FB89304F2081AAD809AB354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0695E280 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695E34B

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9e43861b2b31c0b16ba39102e26f09404946a83bc7adddcbc19d507fef336148
Instruction ID: d727b69ae17f8f932152f369302c4c11b1dc75c465e088f072156edbddf7cd04
Opcode Fuzzy Hash: 9e43861b2b31c0b16ba39102e26f09404946a83bc7adddcbc19d507fef336148
Instruction Fuzzy Hash: EDC1A174E01218CFDB64DFA5D994BADBBB2EB89304F2081A9D809AB354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06957EA0 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06957F6B

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 131a678d6639e0ad9149d13ab9ad8926a6425a92d3ae4e508bcab90eff2e93b3
Instruction ID: 83a61135c83070a7b7a9dd66b7abe5805983b1fd8f772b63c1f3475e3097d75d
Opcode Fuzzy Hash: 131a678d6639e0ad9149d13ab9ad8926a6425a92d3ae4e508bcab90eff2e93b3
Instruction Fuzzy Hash: 2BC1A174E012188FDB64DFA5D954BADBBB2FB89304F2081A9D809AB354DB359E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0695E6D8 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695E7A3

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3bf85affc4d73e3dc17d62eee6792c23252119d98d01fcfa15f286696cc6ca4d
Instruction ID: 7f4bc0c7afae0caea0530059121312e6c6941dcf13242120d71a051e8d6a1ac3
Opcode Fuzzy Hash: 3bf85affc4d73e3dc17d62eee6792c23252119d98d01fcfa15f286696cc6ca4d
Instruction Fuzzy Hash: 2DC1A174E00218CFDB64DFA5D994BADBBB2FB89304F2081A9D809A7355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06954ED8 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 06954FA3

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 58ad1344c79c8b9810eb762dfd9a75fb4e3746ef6511a409b1ab3516562b120b
Instruction ID: 16adb8e917daaa167be914520c2c294790c29dd53376e6f6ec47335cbb5d0518
Opcode Fuzzy Hash: 58ad1344c79c8b9810eb762dfd9a75fb4e3746ef6511a409b1ab3516562b120b
Instruction Fuzzy Hash: 1BC1A174E00218CFDB64DFA5D994BADBBB2EB89304F2081A9D809A7355DB359E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 069534C8 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 06953593

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ecb38e630da606982eb917a94fc53960460e18e17ace5b8cea1bf10111dc43d8
Instruction ID: 5e829f8c0fd5e147e3e2bf0616fb6ff1c459cde42ce846787f5baad8993da8b7
Opcode Fuzzy Hash: ecb38e630da606982eb917a94fc53960460e18e17ace5b8cea1bf10111dc43d8
Instruction Fuzzy Hash: 19C1A274E00218CFDB64DFA5C994BADBBB2FB89304F2081A9D809AB354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 069582F8 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 069583C3

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 105d1b29ece844107c6cb04fd060f055c6dc0a7171cc101a99a39dece2489065
Instruction ID: e4d785f4eca46091ef27548af2e5684d0db657de796365ad34de87a5f3a581ae
Opcode Fuzzy Hash: 105d1b29ece844107c6cb04fd060f055c6dc0a7171cc101a99a39dece2489065
Instruction Fuzzy Hash: 78C1A274E01218CFDB64DFA5C994BADBBB2FB89304F2081A9D809AB354DB345E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 069568E8 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 069569B3

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 91e79c1f508731f1facbd4fdfe8c09fec6999c53ada2c732db1f7b54e35f3c67
Instruction ID: 88a48f520db85d5e8bc5f93414e550ef48c81b4ab22987c7ab0420424cad0423
Opcode Fuzzy Hash: 91e79c1f508731f1facbd4fdfe8c09fec6999c53ada2c732db1f7b54e35f3c67
Instruction Fuzzy Hash: 95C19274E01218CFDB64DFA5D994BADBBB2FB89304F2081AAD809A7354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0695DE00 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695DECB

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 54fb2b51b3e230b4c6e3cf91fd2c2dabc619d77ca3c1c5bc475bee660fe9fb73
Instruction ID: 3e2df7487447dacb52652a6a161e7e997444aeeebaed4f0baeb197300d77acb3
Opcode Fuzzy Hash: 54fb2b51b3e230b4c6e3cf91fd2c2dabc619d77ca3c1c5bc475bee660fe9fb73
Instruction Fuzzy Hash: 15C19274E002188FDB64DFA5D954BADBBB2FF89304F2091AAD809AB354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06956038 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 06956103

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b6398d8c3e60b6706aad2b35dfec5e8223d5699185ac9ada95f03e3ab0e8ea37
Instruction ID: 4c3fe1d03e35255c8531011d6731a613dc363b827bd27f2cf86ea611a8f6aca4
Opcode Fuzzy Hash: b6398d8c3e60b6706aad2b35dfec5e8223d5699185ac9ada95f03e3ab0e8ea37
Instruction Fuzzy Hash: BFC1A274E00218CFDB54DFA5D994BADBBB2FB89304F2081AAD809A7355DB345E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0695F838 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695F903

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fba45735f9ee9bf0657aacb341e65b0d151f35409028b1b90d2bf1b55fb88469
Instruction ID: 2e2568b129379c4484603378c910ee9b51b715a129232c70a313638cdb39db6b
Opcode Fuzzy Hash: fba45735f9ee9bf0657aacb341e65b0d151f35409028b1b90d2bf1b55fb88469
Instruction Fuzzy Hash: D1C1A174E01218CFDB64DFA5D994BADBBB2FB89304F2081A9D809AB354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06954628 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 069546F3

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cd9e7b0e2b112175304cb157f369ce5faa18d2152dae9a0096541925fa6a6540
Instruction ID: a656f557b86d35251af1f588ab609fe6fc94852560e0b1c496f158d858968d07
Opcode Fuzzy Hash: cd9e7b0e2b112175304cb157f369ce5faa18d2152dae9a0096541925fa6a6540
Instruction Fuzzy Hash: A5C1B174E002188FDB64DFA5C994BADBBB2BF89304F2091A9D809A7354DB359E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06957A48 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06957B13

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 753c1be518f7e212be5725db54bfb2b36e30abf8d9c1f760e0219928f108c84a
Instruction ID: cdcd8a35d1cdeb91ca75bc6a0b3bd1af0f6fd029f0bb929db53f6838609f25cf
Opcode Fuzzy Hash: 753c1be518f7e212be5725db54bfb2b36e30abf8d9c1f760e0219928f108c84a
Instruction Fuzzy Hash: BBC19274E01218CFDB64DFA5D954BADBBB2FB89304F2081AAD809AB354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06953070 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695313B

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f3a98e351d11ae3d7060006acf4a0df214babcfbcf9160054b19e5e0c3ada735
Instruction ID: efbe1181f904a331a02f83cbb0b04a7cd138b845935eb66dc0dcf73c8cfc78d0
Opcode Fuzzy Hash: f3a98e351d11ae3d7060006acf4a0df214babcfbcf9160054b19e5e0c3ada735
Instruction Fuzzy Hash: C1C19274E00218CFDB64DFA5D954BADBBB2FB89304F2081AAD809A7354DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06957198 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06957263

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 845a744fd555720d885bc080b38871c0b6bdfeda14e1d44a10505548259973b4
Instruction ID: 0fe829ebe6c23a6e9557f0a8d1e982291cf99d711601d43f497a014e387dfc1b
Opcode Fuzzy Hash: 845a744fd555720d885bc080b38871c0b6bdfeda14e1d44a10505548259973b4
Instruction Fuzzy Hash: FAC19274E00218CFDB54DFA5D994BADBBB2EB89304F2081A9D809AB354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06955788 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 06955853

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 495146009620213ef33cf6151378c4307f516027e6e243062c9efd54e070d8cc
Instruction ID: 0278d6d4a179dea3d920ad3653d0b27eea8a6c2ed99de10cbc71912400011d3f
Opcode Fuzzy Hash: 495146009620213ef33cf6151378c4307f516027e6e243062c9efd54e070d8cc
Instruction Fuzzy Hash: 11C1A274E00218CFDB64DFA5D994BADBBB2BF89304F2081AAD809A7355DB345E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0695EF88 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695F053

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 12f9dfb8328c574861117d94e7a3383e101de777a0c1bf68e925883e36d5777c
Instruction ID: 8751873997fd2efca10864b847d8ae943e6eaf4a6e3ca8cd30a48ca5a9b6a099
Opcode Fuzzy Hash: 12f9dfb8328c574861117d94e7a3383e101de777a0c1bf68e925883e36d5777c
Instruction Fuzzy Hash: 14C19174E012188FDB64DFA5D954BADBBB2BF89304F2081A9D809AB354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 069541D0 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695429B

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e74a47b7b625d95de0ab0cb5525adc50a9b8e9a3b498241aa0c931578b242565
Instruction ID: 08d59db11604a14110e4289031a092b3406c7232292e27ec9eefd75486e7b756
Opcode Fuzzy Hash: e74a47b7b625d95de0ab0cb5525adc50a9b8e9a3b498241aa0c931578b242565
Instruction Fuzzy Hash: 16C19274E002188FDB64DFA5D994BADBBB2AB89304F2081AAD809A7354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 069575F0 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 069576BB

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6c371b0fcbf978aeaf27cd1bff25b15c205f2413b5ef20bec0b0ae7db8a308fb
Instruction ID: e5de6ad6865380a2fd758e97ef27db7ea79060b09287255f2999020f0b6361ea
Opcode Fuzzy Hash: 6c371b0fcbf978aeaf27cd1bff25b15c205f2413b5ef20bec0b0ae7db8a308fb
Instruction Fuzzy Hash: 2FC19374E01218CFDB64DFA5D954BADBBB2FB89304F2081A9D809AB354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06955BE0 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 06955CAB

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4b4e7788b7344a9af86b0b4256529ac9f79ae6f053aca9cdf880dbcc8ca3c4fb
Instruction ID: c2f0104ab4fd070930abee477c2d5f46f7a516cd18c589539ac6346b06624a21
Opcode Fuzzy Hash: 4b4e7788b7344a9af86b0b4256529ac9f79ae6f053aca9cdf880dbcc8ca3c4fb
Instruction Fuzzy Hash: 3AC19174E002188FDB64DFA5D994BADBBB2FB89304F2081A9D809A7355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0695F3E0 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695F4AB

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9aa205bddd8098bb0f6b64ee8c263289c5b41a2a71561ce42ec8227d8230f618
Instruction ID: 2db57ed1eef91f006f4c8482b6b9d5d1140fc869b9adf0b945277c52ccc51264
Opcode Fuzzy Hash: 9aa205bddd8098bb0f6b64ee8c263289c5b41a2a71561ce42ec8227d8230f618
Instruction Fuzzy Hash: 07C1B174E012188FDB64DFA5D994BADBBB2FB89304F2081A9D809AB354DB345E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06955330 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 069553FB

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: da979489fe5b3361dcff26217c8902882989cf423fc6602d6e4198b8358c25c7
Instruction ID: fac807725dce47a266682363b3464f39045d51b48ebd8c708fd48926f5bf4167
Opcode Fuzzy Hash: da979489fe5b3361dcff26217c8902882989cf423fc6602d6e4198b8358c25c7
Instruction Fuzzy Hash: E3C1B274E00218CFDB54DFA5D954BADBBB2EF89304F2081A9D809A7355DB345E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0695EB30 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695EBFB

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 90d865dacf14b51c373148a335f53afd217e2387dc0dd3d21226969c37575cee
Instruction ID: be079c7e6e77049541a53a7a8ff363063ea9f0189b8bb1c970df3b577963314b
Opcode Fuzzy Hash: 90d865dacf14b51c373148a335f53afd217e2387dc0dd3d21226969c37575cee
Instruction Fuzzy Hash: D7C19274E012188FDB64DFA5D994BADBBB2EF89304F2081AAD809A7354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06953920 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 069539EB

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1d4f9ec718953da255d0867c3ea80372ae317d47c51887ec931f1c8050527d73
Instruction ID: 38b53f54a18ac03ace7604c9c1da7b87e3b119dc284be4883ab3d9550db2cf48
Opcode Fuzzy Hash: 1d4f9ec718953da255d0867c3ea80372ae317d47c51887ec931f1c8050527d73
Instruction Fuzzy Hash: 68C19274E00218CFDB64DFA5D954BADBBB2FB89304F2081AAD809A7355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06958750 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695881B

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 879c0a5d127aca2ffeb219397376c0531b4ad4ee1c926aaa4815666dd9a9451b
Instruction ID: 265ce0bf4e2f5c77b51ef63af58e811a672a285cd9b258b574d36a2aa1c82918
Opcode Fuzzy Hash: 879c0a5d127aca2ffeb219397376c0531b4ad4ee1c926aaa4815666dd9a9451b
Instruction Fuzzy Hash: C6C1A174E012188FDB64DFA5D994BADBBB2FB89304F2081A9D809AB354DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06956D40 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06956E0B

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d0045669c014359c612f27212ffa6156bd30ef719189e399c59ca1c52516df2c
Instruction ID: 3c45ceccaa9baf163488370a1b096c8b0f31ec17ff3f5991926fa26c4fe0a834
Opcode Fuzzy Hash: d0045669c014359c612f27212ffa6156bd30ef719189e399c59ca1c52516df2c
Instruction Fuzzy Hash: AEC1A174E012188FDB64DFA5D954BADBBB2BB89304F2081A9D809AB354DB359E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06953D78 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 06953E43

Part of subcall function 06952AD8: KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0338f46dc6497e2911a34042d54621d61936a0f28ed5c70bef8ac674221f43d5
Instruction ID: f38a672e9f0e776225a2277c5c90ce405becff0e1a9b2c85a07d2a4625a84bf8
Opcode Fuzzy Hash: 0338f46dc6497e2911a34042d54621d61936a0f28ed5c70bef8ac674221f43d5
Instruction Fuzzy Hash: 1BC1A274E00218CFDB64DFA5D954BADBBB2AB89304F2081A9D809AB754DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0695E271 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695E34B

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9fed50e98e66c0c6df0264b709f69de708789b331d137c74e68adf7811661bb8
Instruction ID: be5c7a47b61b117946227c22f3f3845f25773eb9e7a5461b09581c8419c376b7
Opcode Fuzzy Hash: 9fed50e98e66c0c6df0264b709f69de708789b331d137c74e68adf7811661bb8
Instruction Fuzzy Hash: 7B410470E05208CBDB58CFAAD9506EEBBB2AF89304F20D12AC814BB254DB355A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069582E8 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 069583C3

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9fcfc8c41b941274208be56b169f8cfaf8507dfad6c6d5d2146dfcb8d56b8e48
Instruction ID: 85189ffac721fda34ed820695bdde63278c2e3fb6db384b58abc2ea42c6424c5
Opcode Fuzzy Hash: 9fcfc8c41b941274208be56b169f8cfaf8507dfad6c6d5d2146dfcb8d56b8e48
Instruction Fuzzy Hash: 7E41F370E01218CBDB58CFAAC9546EEBBB2AF89304F24C12AC815BB754EB345946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069541C0 Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695429B

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f8477c109288958ec3d6e080952ba424bf9e9833605ad8737fb6d5511c84d1d4
Instruction ID: 0a90b8eb4f6bd2e13b731b7fd008db1c3e398eb252441e9f62dda532eaf5d5cb
Opcode Fuzzy Hash: f8477c109288958ec3d6e080952ba424bf9e9833605ad8737fb6d5511c84d1d4
Instruction Fuzzy Hash: A841E370D01208CBDB58DFAAC85469EBBF6AF89304F24D12AC815BB354EB345986CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06957188 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06957263

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b355754001f27c73738cc3508ba762913d954794a05e73f77c0a5efc58a992ae
Instruction ID: e804b4ed889ab0e5e940b6d15539f1bac295ff57bf9a514da960a52a189e1764
Opcode Fuzzy Hash: b355754001f27c73738cc3508ba762913d954794a05e73f77c0a5efc58a992ae
Instruction Fuzzy Hash: 8E41C570D01208CBDB58DFEAD9546EDBBB2AF89304F24D12AC815BB254DB345A46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0695DDF0 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695DECB

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d88e10c1e0e2102f1f4ce217f428b655219b60cca9059965e17dc5cecf1ad7f9
Instruction ID: 280e0678eedf011dfdcda223675e1fce890a31fb9e69b3a3160b5a06b422652b
Opcode Fuzzy Hash: d88e10c1e0e2102f1f4ce217f428b655219b60cca9059965e17dc5cecf1ad7f9
Instruction Fuzzy Hash: 5841E470D01248CBEB18DFAAD9546EDFBB2AF89304F24D12AC814BB254DB355945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06955778 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06955853

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 74a160d6ae06c2e6a1adba1a6767878aab13befbb196956dd2bb14073618a62a
Instruction ID: 7145433f2d24a1f0dd4e76ab56a82aabf9fb71240675705ea698a2816ab9ac58
Opcode Fuzzy Hash: 74a160d6ae06c2e6a1adba1a6767878aab13befbb196956dd2bb14073618a62a
Instruction Fuzzy Hash: 4F41D270E01208CBEB58DFAAD8546EEBBF2AF89304F21D12AC414AB255EB344946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069568D8 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 069569B3

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 55c61031291bfa231073cae29faad0d13095154ef5c0c4e2a16cd8fa62b9a769
Instruction ID: 1d9ca393eb65d756a0926c2a0eb2e8fc5c9c54ea1c7a7068daeb66247900d58d
Opcode Fuzzy Hash: 55c61031291bfa231073cae29faad0d13095154ef5c0c4e2a16cd8fa62b9a769
Instruction Fuzzy Hash: 1941B570E01248CBDB58DFAAD9546EEFBB2AF89304F24D12AC815BB264DB345946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06954619 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 069546F3

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e278b5c6e6a6b2b0a9af2a2f415d4da0556b29c2755cc71f5f437e10901db2ab
Instruction ID: d603c1ca4af6a8b3c89dddc25df974f42d3d034627c583ac7995f617eda14c43
Opcode Fuzzy Hash: e278b5c6e6a6b2b0a9af2a2f415d4da0556b29c2755cc71f5f437e10901db2ab
Instruction Fuzzy Hash: 8641C570E01208CFDB58CFAAD9946EEBBF2AF99304F24D12AC415BB254EB345945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0695F828 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695F903

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d635039831d20fc4cd4ec4be198d55a5c18be7cebad7b36dedf2cc33071d72c2
Instruction ID: aa79f6e60358955abe77d0a684d6af3f8d7f847345ace217a01c141ff65bc022
Opcode Fuzzy Hash: d635039831d20fc4cd4ec4be198d55a5c18be7cebad7b36dedf2cc33071d72c2
Instruction Fuzzy Hash: F841F570E01248CBEB58DFAAD8946DEFBB2AF89304F20D12AC815BB254DB344946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0695EB20 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695EBFB

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 96ec6644df421ee293986373d15ff93871a26643cb68b81215a2fad51a04c93f
Instruction ID: 595da87dc4e90c1302a92e53a46b29619371eda5f5674155e854f40f17195e99
Opcode Fuzzy Hash: 96ec6644df421ee293986373d15ff93871a26643cb68b81215a2fad51a04c93f
Instruction Fuzzy Hash: AD41E370E012088BEB58DFBAD8546EEBBF2AF89304F24D12AC815AB254EB354945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069534B8 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06953593

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cc42e2c9cf5867eab7a5058bd7f31daa5bba673c0fd8de7df483af48c2e23d6d
Instruction ID: 0b3e14ea3268804cb087793600b590cc5bbd9417af069cc23906e9c3583488e8
Opcode Fuzzy Hash: cc42e2c9cf5867eab7a5058bd7f31daa5bba673c0fd8de7df483af48c2e23d6d
Instruction Fuzzy Hash: BF41E370E01208CFEB58CFAAD8546AEBBB2BF89304F24D12AC415BB254EB355946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06954EC8 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06954FA3

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c3a1c23e220f0aabd2f8a151209f5fffc3ab2c6a298ce4189bc159d64a9049c0
Instruction ID: b3b9ad46cf67bd927fdaceccbdad6d47eb5252f37b1b8481516b2bb5aeb9c409
Opcode Fuzzy Hash: c3a1c23e220f0aabd2f8a151209f5fffc3ab2c6a298ce4189bc159d64a9049c0
Instruction Fuzzy Hash: C041F770D01208CBDB58DFAAD8546DEFBF2AF89304F24C12AC814BB254EB345946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0695E6C8 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695E7A3

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d67143980096c0be66fb686ed8cc7286af00b262dabd3056918ce59ce46cf7e2
Instruction ID: 67eeae42b99e331a116cf794e0b13a38d7613428f98d31002ec1b52f66107228
Opcode Fuzzy Hash: d67143980096c0be66fb686ed8cc7286af00b262dabd3056918ce59ce46cf7e2
Instruction Fuzzy Hash: E6412570D01248CBDB18DFBAD8906DEFBB2AF88300F24D12AC814BB254EB354A46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06957A3A Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06957B13

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ab7185925ef623e3c0e7dfa090d7acea523299e80c21a20659dc32589e79d5ee
Instruction ID: b606e710c771fe5c13d63229f0693e09fdaeca4c0ddd82babb7e3b4ba20e6e77
Opcode Fuzzy Hash: ab7185925ef623e3c0e7dfa090d7acea523299e80c21a20659dc32589e79d5ee
Instruction Fuzzy Hash: F541E570D01208CBDB58DFEAD8546EEFBB2AF89304F20D12AC415AB264EB345A46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0695602A Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06956103

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 05a2597d2686fce0bb4796954d9e45b7f6aaf4f53fe5c8036894032a5ce6c5b0
Instruction ID: 329d2fc78b3ae96d25c568cee0cdc13fa82000c5a9e302c53d259a697f24bbc0
Opcode Fuzzy Hash: 05a2597d2686fce0bb4796954d9e45b7f6aaf4f53fe5c8036894032a5ce6c5b0
Instruction Fuzzy Hash: F441E370E01208CBDB58DFAAD9546EEFBB2AF89304F24D12AC815BB265DB344946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06953062 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695313B

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8200147c2ac946e049b17095dacf2313962571e6c737245e4d763e3bad3abd39
Instruction ID: 521e53d0d8c8bc5a2a9cb23d80d637d0a40b8cfe747f75cdb72169f17a3cd591
Opcode Fuzzy Hash: 8200147c2ac946e049b17095dacf2313962571e6c737245e4d763e3bad3abd39
Instruction Fuzzy Hash: 2E41E170E01208CBEB58CFBAD8546AEFBB2AF89304F24D12AC814BB254EB355945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0695F3D0 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695F4AB

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4251a6a68f713de5487549b70017294e8e9dd92812e272fb59b093ecdbb07f1e
Instruction ID: 25f1c9d9df59e3662f066416951d1b53527f7165d662e526c1a342f1456dcff2
Opcode Fuzzy Hash: 4251a6a68f713de5487549b70017294e8e9dd92812e272fb59b093ecdbb07f1e
Instruction Fuzzy Hash: 2341C270E01208CBEB58DFBAD9546AEFBB2AF89314F20D12AC815AB254EB344945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069575E0 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 069576BB

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 673c16ec35e2104d191e48113c751e70c6fc63df1e35eeca16629422a5b4068a
Instruction ID: bfd747e81f28dfa706cf9dc4f53d8d64dbadd527dddf8df97dfc74784896f6d5
Opcode Fuzzy Hash: 673c16ec35e2104d191e48113c751e70c6fc63df1e35eeca16629422a5b4068a
Instruction Fuzzy Hash: 2441D270E01208CBEB58DFAAD8546AEBBB2AF89304F24D12AC815BB254DB345945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06953910 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 069539EB

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0a9f854a7cdb5014b2b44b480198573829cfa037cf0f25261443f494927d36f3
Instruction ID: 4ccd204b58bde069f13c4b1cb4802a94a8edcd52d2de42a45105c36f7c4f7310
Opcode Fuzzy Hash: 0a9f854a7cdb5014b2b44b480198573829cfa037cf0f25261443f494927d36f3
Instruction Fuzzy Hash: 3041D270E01208CBEB58DFBAD9546DEBBB6AF89344F24D12AC818BB254EB345945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06956D36 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06956E0B

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 90fef762df778489e32b00d3c9312b716904f757cbb74bb9a95ea116b630df67
Instruction ID: 21471279d3ca80ce4328a16fcab73fd7dfcdf7bfc8cddb1cc7e1bf2d23e0ee06
Opcode Fuzzy Hash: 90fef762df778489e32b00d3c9312b716904f757cbb74bb9a95ea116b630df67
Instruction Fuzzy Hash: B441B470D01248CBDB58DFBAD9546EEBBF2AF89304F24D12AC415BB254EB344945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06955321 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 069553FB

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8a0043bec62989a12d6b6fefcd630e8982dd0b5e910466fe41681a1ac030d50b
Instruction ID: 6c46b21851a3423f46692d23b8330790adbb6d8692f9deb083e04496589020fd
Opcode Fuzzy Hash: 8a0043bec62989a12d6b6fefcd630e8982dd0b5e910466fe41681a1ac030d50b
Instruction Fuzzy Hash: 9841F470E01208CBEB58DFBAD8546EEBBF2AF89304F25D12AC814BB255EB345945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06958741 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695881B

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5c51da0f6cc1475515dee6f203f2150f326b774936be9b301ae55efddc6b5859
Instruction ID: f3b4bfef80e2b150b9a07b666412bbca9edd7e945b652e3d59d5a98906bcf5af
Opcode Fuzzy Hash: 5c51da0f6cc1475515dee6f203f2150f326b774936be9b301ae55efddc6b5859
Instruction Fuzzy Hash: 5341D470E01218CFEB58DFAAD9546ADBBF2BF89304F24D12AC818BB254EB355945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0695EF79 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695F053

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1cdbca392c7b46bd9ed50d54f8d60dae05c97cc0ce822a058e7f4c8ce87b8f9b
Instruction ID: 77e675dcadab315fa68c6e4c6f93e7383fc8d92b9860d3c2d8e72128fa4c3693
Opcode Fuzzy Hash: 1cdbca392c7b46bd9ed50d54f8d60dae05c97cc0ce822a058e7f4c8ce87b8f9b
Instruction Fuzzy Hash: A241F570D012488BEB58DFBAD9546AEFBB2AF89304F24D12AC815BB254EB345945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06953D68 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06953E43

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3fb97e85ab56c76fc604743fb4e06a670c7f42ec4e0087a40ae95d987bf28e71
Instruction ID: 5b0efe04b0de6da515f3979b6706851f3caa422e06053c57e15ae74023a18676
Opcode Fuzzy Hash: 3fb97e85ab56c76fc604743fb4e06a670c7f42ec4e0087a40ae95d987bf28e71
Instruction Fuzzy Hash: D941E570D01208CBEB58CFAAD8546AEFBF2AF99304F24D12AC815BB254EB345946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06957E90 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06957F6B

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 94a47867f64add253ab518a70d123e9500c95032325c094910280a0616a7850c
Instruction ID: a89f94bddd42a6901b147d97152862941c2a1beac359a8fb1a3038c09105c989
Opcode Fuzzy Hash: 94a47867f64add253ab518a70d123e9500c95032325c094910280a0616a7850c
Instruction Fuzzy Hash: B741D270E01608CBEB58DFAAD9546EEBBB2BF89304F24D12AC814BB264DB345945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06956482 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0695655B

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3a7e062b175f13fe1ef10f697322df019b30a65e1eec3b8af352037d387cbd36
Instruction ID: 57f6ee8d44e6f1f068a68ee03ab2149eba87942f59b047182abaf18a41340d8b
Opcode Fuzzy Hash: 3a7e062b175f13fe1ef10f697322df019b30a65e1eec3b8af352037d387cbd36
Instruction Fuzzy Hash: AC41D670D01208CBDB58CFAAD9546EEBBF2AF89304F24D12AC414BB269DB345946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06954A70 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06954B4B

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 199029c8e623a51b9cf6dd59368126c7500c016992396e6f41d24f26d225bbaa
Instruction ID: 94d8aa610a9a3be7f3f90632adf8d46ba39594483a3008bdd87565aa7f7102a2
Opcode Fuzzy Hash: 199029c8e623a51b9cf6dd59368126c7500c016992396e6f41d24f26d225bbaa
Instruction Fuzzy Hash: 7641E470E01248CBDB58DFAAD8546EEBBF2AF89304F24D12AC815BB354EB344985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06955BDA Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 06955CAB

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3d966db68bde4787973c103bd71ddf491bff8cb3b8797ae229b8d8d5d247888c
Instruction ID: f460f7e01b50af1e568b48f05579d31bcc4e70bf1c69ff192249c16954195e66
Opcode Fuzzy Hash: 3d966db68bde4787973c103bd71ddf491bff8cb3b8797ae229b8d8d5d247888c
Instruction Fuzzy Hash: CA41E470E01208CBDB58DFAAD95469EBBB2BF89304F21D12AC814BB255EB344945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016BE758 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2006be056d9f7eeb1886f0ac76af5a6723a6cd79a8635622ea7a6c9dc8b40ad
Instruction ID: 46a9fe9fcc899719dca4b990208fbfa3c40ddcaf0f4ecfd877909c7c91ad4684
Opcode Fuzzy Hash: b2006be056d9f7eeb1886f0ac76af5a6723a6cd79a8635622ea7a6c9dc8b40ad
Instruction Fuzzy Hash: ED122874E012188FDB14DFB9C9947EDBBB2AF89304F2481AAC409A7395DB359D85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016B6B88 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01c3340119689784b692a4ff5c5dc76fe6c18ced71bfc13ab41913d5c833d92
Instruction ID: d25fc3b7d04661eb283ce4c1697252681a6e7bcedf4fe0f91e63fe54580a9d5d
Opcode Fuzzy Hash: e01c3340119689784b692a4ff5c5dc76fe6c18ced71bfc13ab41913d5c833d92
Instruction Fuzzy Hash: 10F1C2B4E012188FDB14DFA9C884BDDFBB6BF88304F1481A9D809AB395DB749985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016B7196 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5142876becba7bbc1d4cc65b1b4f859c7c44b09b8656427d918072186ab0f14
Instruction ID: 3fd957a45d9c8605186a631be7b6520591d80ac6b3d67483b21d720bcc0e8b6c
Opcode Fuzzy Hash: e5142876becba7bbc1d4cc65b1b4f859c7c44b09b8656427d918072186ab0f14
Instruction Fuzzy Hash: B3F10574D01218CFDB19CFA4D994B9DBBB2FF89304F2091AAD409AB2A5D7359E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016B7F68 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c253ea8a0010762a5ede39841c39649ec0a4bee7ae02829bc28d542911b7ad84
Instruction ID: df0d401bbb5a0dcf2796d466fbf85bc159ee7e3bf14fc05f565d0b42ebcd7b14
Opcode Fuzzy Hash: c253ea8a0010762a5ede39841c39649ec0a4bee7ae02829bc28d542911b7ad84
Instruction Fuzzy Hash: A4D1C274E01218CFDB24DFA5D994BADBBB6FB89304F2081AAD409A7354DB349E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016BFB30 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddcff4bae8e3345e407aac0523fbd03274638bfa43b4aa0d4668c7a1da211817
Instruction ID: 46b43126b851a76ae8d9a4b977623c8ee0b5f28da628b6157b80e8210fbbe92c
Opcode Fuzzy Hash: ddcff4bae8e3345e407aac0523fbd03274638bfa43b4aa0d4668c7a1da211817
Instruction Fuzzy Hash: 73C1B274E012188FDB24DFA5D994BADBBB2FF89304F2081A9D809AB355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016B7B08 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63096fc1adeaf0fe520e442e6e8ccc2aa7c36d304fd607bf3b4bd45774cebd10
Instruction ID: fc5c0ede6b57a56a1267adb870b27f06de654d2bc2b07930a7079eda14a49cf9
Opcode Fuzzy Hash: 63096fc1adeaf0fe520e442e6e8ccc2aa7c36d304fd607bf3b4bd45774cebd10
Instruction Fuzzy Hash: 14D1A174E01218CFDB24DFA5D994BADBBB2FB89304F2081AAD809A7355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016BF280 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb6959731fdaace474193565768ee5189f5726a1cf686df6366ca3578eb2176
Instruction ID: a02dba2b377efde4509f709a6867fde82fc438e5355696263ca438327516b412
Opcode Fuzzy Hash: aeb6959731fdaace474193565768ee5189f5726a1cf686df6366ca3578eb2176
Instruction Fuzzy Hash: 74C1A274E01218CFDB64DFA5D994BADBBB2FB89304F2081A9D809AB355DB345E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016BEE28 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad15dd7c8c3b4862b6f37cbac621a70ba77d93773349acca315265a486a6933
Instruction ID: 8f473bd61a6040bfbf070af486eede6676b88ced8201583849dd934f240d39f4
Opcode Fuzzy Hash: fad15dd7c8c3b4862b6f37cbac621a70ba77d93773349acca315265a486a6933
Instruction Fuzzy Hash: BFC1B174E00218CFDB64DFA5D994BADBBB2BB89304F2081A9D809AB355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016BF6D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 583fc102b4acfb5d4c86521eef18c11757d4d97ab41c45327e651e9132464a4b
Instruction ID: 1eb9138901e0bb17a837743f60986fb32fce9d85b588e2a76dac0b61ef5f6142
Opcode Fuzzy Hash: 583fc102b4acfb5d4c86521eef18c11757d4d97ab41c45327e651e9132464a4b
Instruction Fuzzy Hash: 9BC1B174E00218CFDB64DFA5D994BADBBB2FB89304F2081A9D809AB355DB345E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016B76A8 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a395098e028b40965d7e47c84f9c9cef2318d410ae5cecaa7320bd796f397475
Instruction ID: d422fa312ff0839bc879b4dc01be107385a73d8eba68e894edda9851d955bcee
Opcode Fuzzy Hash: a395098e028b40965d7e47c84f9c9cef2318d410ae5cecaa7320bd796f397475
Instruction Fuzzy Hash: F9C1B174E01218CFDB64DFA5D994BADBBB2BB89304F2081AAD809A7355DB345E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 016B66E8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b135c074408badf01fa8ebbae015b2ebcbaa2422f160debaf21b610016a39ca
Instruction ID: 385376d2194016bb4ef7015f2cd201259e8087e5dacfba6bb30f7232fd022922
Opcode Fuzzy Hash: 7b135c074408badf01fa8ebbae015b2ebcbaa2422f160debaf21b610016a39ca
Instruction Fuzzy Hash: 15A1E170A012188FEB24DFA9C984BDDBBB1BF89304F209269D409AB391DB759985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 016B66F8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac65f1b464ac8cb31a48d42e7078e0d93a90148db5722f54f3e8a0f1cda6134
Instruction ID: d116d627bd25be71ef7da7bad5a39c112750d58d7a541e1bf6719b65e063cce1
Opcode Fuzzy Hash: 3ac65f1b464ac8cb31a48d42e7078e0d93a90148db5722f54f3e8a0f1cda6134
Instruction Fuzzy Hash: CCA1E2B0D01218CFEB24DFA9C984BDDBBB1BF89304F209269D509AB391DB749985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 016B6A3E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a84fbdc900c64d4d62e540e0b07c0cb9aac8a86502b99775819594f00307a94
Instruction ID: b36032eea3e4e6a69cf956d9aa87f1070b1c8b7a4cd5c4e4e5c16f6d5272abda
Opcode Fuzzy Hash: 6a84fbdc900c64d4d62e540e0b07c0cb9aac8a86502b99775819594f00307a94
Instruction Fuzzy Hash: D991E070A01218CFEB24DFA9C884BDDBBB1FF49314F209269E509AB391DB759985CF14

Uniqueness

Uniqueness Score: -1.00%

Function 016B3450 Relevance: 1.7, APIs: 1, Instructions: 192COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016B3506

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f68fd04c99f97c4ecc5cefaa4c9817fb357de93598ddaa6e999e56d5edb24658
Instruction ID: 2f2d68163b0ea66b14346d161c755b888babfb36c87a1c6da7ae0d2ea6ff7f57
Opcode Fuzzy Hash: f68fd04c99f97c4ecc5cefaa4c9817fb357de93598ddaa6e999e56d5edb24658
Instruction Fuzzy Hash: 9251EE34462742DFC3386F60AAAD1BABBB1FB4F313766BC10E45B92148DB74025A8F11

Uniqueness

Uniqueness Score: -1.00%

Function 016B3460 Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016B3506

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e8317501120c6a51ed49188acfc70621a055f1e57ee20d3308fb9b41cb7b87a0
Instruction ID: 557a5b8304fffc1c90edc6b2f712f6ccad794e978ebee1bbe2ffe17b473d7dc3
Opcode Fuzzy Hash: e8317501120c6a51ed49188acfc70621a055f1e57ee20d3308fb9b41cb7b87a0
Instruction Fuzzy Hash: 7651EF34462742DFC3382F61AAAD1BEBBB5FB4F313762BC10E41B920088B74025A8F11

Uniqueness

Uniqueness Score: -1.00%

Function 06952AD8 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(000000FF), ref: 06952C3A

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e525314950fa953434af2511290330840f43b9feba36b5370c207c435fad54b3
Instruction ID: 389979ab11a2dba8b66a28249efe98dcfad69ef1ed7a09c663442f1d26b52f4d
Opcode Fuzzy Hash: e525314950fa953434af2511290330840f43b9feba36b5370c207c435fad54b3
Instruction Fuzzy Hash: B55103B0D00218CFDB18DFAAD8846DEBBB2BF89314F10C529D815AB294DB749945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06952C73 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081dc3940413b6da95a036ef158d488708a9798a4fcc819d0c67ce5c153f08b8
Instruction ID: ee29ef6a347c673a3f8f419654e32f02f60ddc1bc9a9b6ce9cb48fb66cdbd496
Opcode Fuzzy Hash: 081dc3940413b6da95a036ef158d488708a9798a4fcc819d0c67ce5c153f08b8
Instruction Fuzzy Hash: AA5120B4D00208CFDF54DFA9D4846EDBBB2BF09324F21852AE819BB690D7349A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06952F2C Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb8066c26aec0e812b6236527f6c86436c45e4fbfbafd04f7e5bfa9d5085d748
Instruction ID: c047f1bca2051bf3e5362aea307f61d4dbb08eca8b79d56c2f1d4b530a582d3e
Opcode Fuzzy Hash: bb8066c26aec0e812b6236527f6c86436c45e4fbfbafd04f7e5bfa9d5085d748
Instruction Fuzzy Hash: A8416D74904109CFCB14CFA8D4809EDFBB6FF48314F669259D819AB795C731AA8ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 06952ECC Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62da9d05b64b383edd8f6e8bfd3f526469a82898e118d2c4154e4bf592a8de6d
Instruction ID: 1fcd8e3177a57797b0dec3ae026be957f1f06958436cdb551d6b45af9515d438
Opcode Fuzzy Hash: 62da9d05b64b383edd8f6e8bfd3f526469a82898e118d2c4154e4bf592a8de6d
Instruction Fuzzy Hash: 78411874E04109CFDB54CFA8E484AECF7B6FF48314F258159E809A7695C731AA8ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 06952D81 Relevance: 1.6, APIs: 1, Instructions: 102libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 06952DE1

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 87767b222b334b919c95fda2dbffe12cd28a98ff50ff8fd79c43a7cca8ac3a22
Instruction ID: a0614e3e015b52a76338946e39c526ebe5d8be872028d12fc520651366f6a989
Opcode Fuzzy Hash: 87767b222b334b919c95fda2dbffe12cd28a98ff50ff8fd79c43a7cca8ac3a22
Instruction Fuzzy Hash: E8414CB4E001099FDB14CF99D584AEDFBB6BF88304F258159D80967785C731AA8ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 0161D4F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560215138.000000000161D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0161D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_161d000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf0cba32a2496605ee1b5f9b4795b04bc74e508cee6b846030f76e17c6e7209
Instruction ID: 1fd6361e614990e6e542b1263b1f944cc13b4f7c822703382ba9e366e4444da3
Opcode Fuzzy Hash: 9bf0cba32a2496605ee1b5f9b4795b04bc74e508cee6b846030f76e17c6e7209
Instruction Fuzzy Hash: 2A2125B1504240DFDB05DF54DDC4B26BF65FB88328F288569E8060B70AC336D95ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0162D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560277567.000000000162D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_162d000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5fd55ef32b3cd8a7d639576b53a7f84a17bded93c17ea2a3153e6d260e99b7
Instruction ID: dda63d0629d1867f39ed401c398088eb2b33244e10094ae054c4e102ea8a74be
Opcode Fuzzy Hash: 7a5fd55ef32b3cd8a7d639576b53a7f84a17bded93c17ea2a3153e6d260e99b7
Instruction Fuzzy Hash: 74212271604640DFCB11CF54DDC0B16BB61FB88354F24C969D80A0B7A6C33AD84BCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0162D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560277567.000000000162D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_162d000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0106ef65bc7319316cab996adce34ced29937dfe5d9cffc4985d4a67c08405d
Instruction ID: 0036f6296a6e41f11cc71510c33b87f48fc137fa157b6f02be9dd4f4c07783f6
Opcode Fuzzy Hash: e0106ef65bc7319316cab996adce34ced29937dfe5d9cffc4985d4a67c08405d
Instruction Fuzzy Hash: 142180754087809FCB02CF24D994B15BF71EB46314F28C5DAD8458B6A7C33A9856CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0161D4EB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560215138.000000000161D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0161D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_161d000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5e0b608e762b73065f3240f20cc597103337480dfea35710c9739bf98176558
Instruction ID: a6f7afb58ed5af5820d6f9c6e958368caf84f49508be57a12a92e717370fb8ed
Opcode Fuzzy Hash: a5e0b608e762b73065f3240f20cc597103337480dfea35710c9739bf98176558
Instruction Fuzzy Hash: AC11BE76404280CFDB16CF54D9C4B1ABF71FB88324F2886A9D8050B61BC33AD55ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 016B4AA8 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.560418816.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16b0000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a729c3f31f20117c92f9d07b3bcaa7c69aceacfbcc81c154967454f619df244
Instruction ID: 89db0dfff1f90344fb845c6258f165b819d93b8ed7dd348926bbc3c58ede5c09
Opcode Fuzzy Hash: 1a729c3f31f20117c92f9d07b3bcaa7c69aceacfbcc81c154967454f619df244
Instruction Fuzzy Hash: 7F52AC74A012288FDB64DF69C984BEDBBB2BF89305F1081EAD409A7354DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0695C020 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1b140f0e1d3bde59eecd7546b36a93169d29e22008cf6205265a078be7929f
Instruction ID: 8c61e32b08fa3edee11f76b5668ae5aa451605c6e8d5a6f4a8ff98f3c37a97c2
Opcode Fuzzy Hash: 8f1b140f0e1d3bde59eecd7546b36a93169d29e22008cf6205265a078be7929f
Instruction Fuzzy Hash: E4B1B574E00218CFDB54DFA9D894A9DBBB2FF89304F2081A9D819AB365DB34AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0695C00F Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff16eeb17e4021fc83c1292853ca1af16c946724b8f6171126111e4b2afd8ac
Instruction ID: 419ee18fa23b22a135ea5843fad3a0ee5c8efc1b8f80f6fe4fa14e52db862ac3
Opcode Fuzzy Hash: 6ff16eeb17e4021fc83c1292853ca1af16c946724b8f6171126111e4b2afd8ac
Instruction Fuzzy Hash: B3516274E00608CFDB48CFAAD994A9DBBF2FF89300F259169D819AB365DB349941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0695C336 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.563072376.0000000006950000.00000040.00000800.00020000.00000000.sdmp, Offset: 06950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6950000_l9qmoY93Ed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85dd9465f647a1ca791f13ea3c599f8bac092379a6f32be007a3753950d3dd51
Instruction ID: 5ac1eecc8303e624e470ff2544ed9d2ca897b8e8e6aa38ccc1df1e0f63738438
Opcode Fuzzy Hash: 85dd9465f647a1ca791f13ea3c599f8bac092379a6f32be007a3753950d3dd51
Instruction Fuzzy Hash: 80D09E74D04259CACF10DF65DD503EDB372BB96200F0565D9841DB3650DB305E988F86

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report l9qmoY93Ed.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\l9qmoY93Ed.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
l9qmoY93Ed.exe

Function 00D4B880 Relevance: 6.1, APIs: 4, Instructions: 126
threadCOMMON

Function 00D4B890 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 00D495A8 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 00D45364 Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Function 00D43CAC Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00D4BAB0 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Function 00D4BAB8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 00D49A08 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Function 00D48900 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00D49788 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 016B5587 Relevance: 2.1, APIs: 1, Instructions: 633
libraryCOMMON

Function 016B83C9 Relevance: 1.8, APIs: 1, Instructions: 274
COMMON

Function 016B6111 Relevance: 1.8, APIs: 1, Instructions: 272
COMMON

Function 06954A80 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre