Edit tour

Windows Analysis Report
Firewall Security.exe

Overview

General Information

Sample Name:	Firewall Security.exe
Analysis ID:	1317420
MD5:	4d6800baf908cecb930a18f6359274f5
SHA1:	1579141f4500259c384d07f6b63101fa2fb047b7
SHA256:	fa55ce1ea601880ae7844817604add6a2105ed59394e0dc61195fcde086bc0d1
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Creates a DirectInput object (often for capturing keystrokes)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Potential key logger detected (key state polling based)

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

Firewall Security.exe (PID: 7556 cmdline: C:\Users\user\Desktop\Firewall Security.exe MD5: 4D6800BAF908CECB930A18F6359274F5)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Firewall Security.exe	ReversingLabs: Detection: 30%
Source: Firewall Security.exe	Virustotal: Detection: 35%			Perma Link

Source: Firewall Security.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\Dell\source\repos\Network Security Premium\Network Security Premium\obj\Debug\Network Security Premium.pdb source: Firewall Security.exe

Source: Firewall Security.exe, 00000000.00000002.1161743937.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp, Firewall Security.exe, 00000000.00000002.1162103438.0000000006052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: Firewall Security.exe, 00000000.00000002.1161583859.00000000010EA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

memstr_c1ebb228-9

Source: C:\Users\user\Desktop\Firewall Security.exe

Code function: 0_2_09928BD0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_09928BD0

Source: Firewall Security.exe, 00000000.00000000.895024110.0000000000B96000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNetwork Security Premium.exeR vs Firewall Security.exe
Source: Firewall Security.exe, 00000000.00000002.1161743937.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNetwork Security Premium.exeR vs Firewall Security.exe
Source: Firewall Security.exe, 00000000.00000002.1161743937.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Firewall Security.exe
Source: Firewall Security.exe, 00000000.00000002.1161743937.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ${q,\\StringFileInfo\\000004B0\\OriginalFilename vs Firewall Security.exe
Source: Firewall Security.exe	Binary or memory string: OriginalFilenameNetwork Security Premium.exeR vs Firewall Security.exe

Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_02EAC444	0_2_02EAC444
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_02EADBD0	0_2_02EADBD0
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_08F8A038	0_2_08F8A038
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_08F87260	0_2_08F87260
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_08F8F5B8	0_2_08F8F5B8
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_08F8F5B8	0_2_08F8F5B8
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_099230D0	0_2_099230D0
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_09920320	0_2_09920320
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_09926590	0_2_09926590
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_09926038	0_2_09926038
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_09920310	0_2_09920310
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_099230D0	0_2_099230D0

Source: Firewall Security.exe	ReversingLabs: Detection: 30%
Source: Firewall Security.exe	Virustotal: Detection: 35%

Source: C:\Users\user\Desktop\Firewall Security.exe

File read: C:\Users\user\Desktop\Firewall Security.exe:Zone.Identifier

Jump to behavior

Source: Firewall Security.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Firewall Security.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Firewall Security.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Firewall Security.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll			Jump to behavior

Source: classification engine

Classification label: mal48.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Firewall Security.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Firewall Security.exe

Static file information: File size 1810432 > 1048576

Source: Firewall Security.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Firewall Security.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Firewall Security.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x16c400

Source: Firewall Security.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Firewall Security.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\Dell\source\repos\Network Security Premium\Network Security Premium\obj\Debug\Network Security Premium.pdb source: Firewall Security.exe

Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_02EAE730 push eax; ret	0_2_02EAE731
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_099211FB pushfd ; iretd	0_2_09921201
Source: C:\Users\user\Desktop\Firewall Security.exe	Code function: 0_2_09925E10 push eax; mov dword ptr [esp], edx	0_2_09925E24

Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Firewall Security.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Users\user\Desktop\Firewall Security.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Firewall Security.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Firewall Security.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Disable or Modify Tools	2 Input Capture	13 System Information Discovery	Remote Services	2 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Firewall Security.exe	30%	ReversingLabs	Win32.PUA.Generic
Firewall Security.exe	36%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Virustotal		Browse
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	1%	Virustotal		Browse
http://www.founder.com.cn/cn/bThe	1%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp, Firewall Security.exe, 00000000.00000002.1162103438.0000000006052000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Firewall Security.exe, 00000000.00000002.1161743937.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Firewall Security.exe, 00000000.00000002.1162146745.0000000007142000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1317420
Start date and time:	2023-10-01 04:40:54 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Firewall Security.exe
Detection:	MAL
Classification:	mal48.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 40 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, displaycatalog.mp.microsoft.com, g.bing.com, arc.msn.com
Report size getting too big, too many NtAllocateVirtualMemory calls found.

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.038637255620245
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Firewall Security.exe
File size:	1'810'432 bytes
MD5:	4d6800baf908cecb930a18f6359274f5
SHA1:	1579141f4500259c384d07f6b63101fa2fb047b7
SHA256:	fa55ce1ea601880ae7844817604add6a2105ed59394e0dc61195fcde086bc0d1
SHA512:	01a053bcddb30190ed171fd594a78fbdf34e72ff6f709f8b44b4a98db7be3d110d4f57c46264286387c1878b78a5f2b3b1b3a657c9a1a606765e99e5db02e7af
SSDEEP:	6144:bsl+BvlcILZd0oY7wg0OGPE3pzBlsK1nhcLHGQ:b1lNLT0oY7H0OGPE3plaK1EGQ
TLSH:	BB85EF7314095449D07A8EF00315FFB6405EAC7E049987DEA9EBFD43A63628FEC61A27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B.Z.........."...P.................. ........@.. ....................................`................................

File Icon


Icon Hash:	0f0b1d8b1b0b3997

Static PE Info

General

Entrypoint:	0x56e3ca
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5AD8429F [Thu Apr 19 07:17:51 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16e378	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x170000	0x4d7cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1be000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x16e240	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16c3d0	0x16c400	False	0.11373501308339053	data	3.835831492359187	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x170000	0x4d7cc	0x4d800	False	0.20701234879032257	data	3.947941815599056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1be000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x1701c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.6578014184397163
RT_ICON	0x170640	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2835 x 2835 px/m	0.49385245901639346
RT_ICON	0x170fd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.41393058161350843
RT_ICON	0x172090	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.2945020746887967
RT_ICON	0x174648	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.23488427019367028
RT_ICON	0x178880	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 2835 x 2835 px/m	0.16767395417279798
RT_ICON	0x181d38	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.1369632083284041
RT_ICON	0x192570	0x25228	Device independent bitmap graphic, 192 x 384 x 32, image size 147456, resolution 2835 x 2835 px/m	0.1037382317361805
RT_ICON	0x1b77a8	0x5be0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9979166666666667
RT_GROUP_ICON	0x1bd398	0x84	data	0.7272727272727273
RT_VERSION	0x1bd42c	0x39c	data	0.3906926406926407

Imports

DLL	Import
mscoree.dll	_CorExeMain

• Firewall Security.exe

Click to jump to process

Memory Usage

• Firewall Security.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Target ID:	0
Start time:	04:41:46
Start date:	01/10/2023
Path:	C:\Users\user\Desktop\Firewall Security.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Firewall Security.exe
Imagebase:	0x9e0000
File size:	1'810'432 bytes
MD5 hash:	4D6800BAF908CECB930A18F6359274F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.3%
Total number of Nodes:	175
Total number of Limit Nodes:	11

Executed Functions

Function 08F8A038 Relevance: 2.8, Strings: 2, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&{q, xrefs: 08F8A309
, xrefs: 08F8A0D4

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID:
String ID: $(&{q
API String ID: 0-815821125
Opcode ID: db1d4e89fa6b9a9f09c0a3b785fabd87cb9e15cc1e96fd7032eecd2a302fe28b
Instruction ID: 657c6c5512178fe48522ab69d5294611e78bd7a9227d823e3653266f4fd0dbad
Opcode Fuzzy Hash: db1d4e89fa6b9a9f09c0a3b785fabd87cb9e15cc1e96fd7032eecd2a302fe28b
Instruction Fuzzy Hash: 8D9182B1E006199FDB18EF79C854AAFBBF6EF88301F10852AE405E7340EB359D058B95

Uniqueness

Uniqueness Score: -1.00%

Function 09920320 Relevance: 1.9, Strings: 1, Instructions: 693
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fff?, xrefs: 09920987

Memory Dump Source

Source File: 00000000.00000002.1162350936.0000000009920000.00000040.00000800.00020000.00000000.sdmp, Offset: 09920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9920000_Firewall Security.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: f2caa8c32a4bfcdcb8d983e71f887d8b0de9520a58594804780f9766945f014f
Instruction ID: 162684e15e9b0f48a63636cc9f3e3dfcd23b38217008f4370ab9086efd492914
Opcode Fuzzy Hash: f2caa8c32a4bfcdcb8d983e71f887d8b0de9520a58594804780f9766945f014f
Instruction Fuzzy Hash: D8624A3581061ADFCF11DF60C884AD9B7B2FF99304F1586D5E9086B125EB72AAD5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 08F8F5B8 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5194b86159c86d74858d64edb2a93d4df986d23f647b8a1f58b658baee17dcfa
Instruction ID: 5ad33ec15b28f8709254717f86e2e85c615dcce32eb03d0d38f8cc3684b3eead
Opcode Fuzzy Hash: 5194b86159c86d74858d64edb2a93d4df986d23f647b8a1f58b658baee17dcfa
Instruction Fuzzy Hash: C7520735A10619CFCB21EF74C854AA9BBB5FF49311F1485D9E509AB261EF31EA82CF40

Uniqueness

Uniqueness Score: -1.00%

Function 099230D0 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1162350936.0000000009920000.00000040.00000800.00020000.00000000.sdmp, Offset: 09920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9920000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83eb6bf2b554d44c193f800ddac7ae097839f0b72714f1b39e244532ea0f0284
Instruction ID: cdff8af59679c129cf1d32db29e2d89545a377998001436ff51c825574eeebe4
Opcode Fuzzy Hash: 83eb6bf2b554d44c193f800ddac7ae097839f0b72714f1b39e244532ea0f0284
Instruction Fuzzy Hash: 9432393591062ACFCB21DF64C945BD9B7B6FF89300F1085E9E409AB260EB75EA85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 08F87260 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: f1f2c99c07e76b7afb005dbb46cb3352a43ada509f5758a0291a4e48fec5ed65
Instruction ID: d51a54c9fe84c83e2514a2aac04781e5277ee1de3613ca991ff896b70f385c14
Opcode Fuzzy Hash: f1f2c99c07e76b7afb005dbb46cb3352a43ada509f5758a0291a4e48fec5ed65
Instruction Fuzzy Hash: E4F14D71E00209CFDB14EFA9C988BADBBF1BF48305F258559E409AF3A5DB74A945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02EAD4C8 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02EAD72E

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a48a61e6c5f37c22ce197127d361d3fca19c006797a6e3501f9b0974523ba590
Instruction ID: b6a7dfbb1c54cab2f32678f3799e6317b65d02ae729e4c7ace5818a02a5583f6
Opcode Fuzzy Hash: a48a61e6c5f37c22ce197127d361d3fca19c006797a6e3501f9b0974523ba590
Instruction Fuzzy Hash: 088126B0A00B058FD724DF29D45475ABBF5BF88308F10992EE48ADBA40DB35F945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02EAC7CC Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02EAF7E2

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 27e26568d96ebf4b162679079c7aac60994932a0a9240b2b362295e958c091c3
Instruction ID: cde16761f7748f9ef42a4514e4e2eeaf8bd7be3ba96bac8fcf3b56ed111ed002
Opcode Fuzzy Hash: 27e26568d96ebf4b162679079c7aac60994932a0a9240b2b362295e958c091c3
Instruction Fuzzy Hash: 0151C0B1D10309DFDF14CF99C994ADEBBB5BF88314F24812AE819AB210D775A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02EAF6C4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02EAF7E2

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 19df7c7f43cc61b433e07562bb4d5f32fc25ce13eda0a5d27eeaf1856d0103a9
Instruction ID: b24cbdd0db3cd1196e0cf7ec54c5d5498ba41d94cc411059ae049e1f26b12796
Opcode Fuzzy Hash: 19df7c7f43cc61b433e07562bb4d5f32fc25ce13eda0a5d27eeaf1856d0103a9
Instruction Fuzzy Hash: A451B0B1D10349DFDF14CF99C994ADEBBB5BF48314F24812AE819AB210D775A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02EAC778 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,02EAF900,?,?,?,?), ref: 02EAFD75

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f32fde8c909fe7b3923199243fc276d9318ae85556c27661b8491ec9b3397418
Instruction ID: def8f9aeccadb1f6baa496c7942c73218be6725410496df42fdf4ed107a735c6
Opcode Fuzzy Hash: f32fde8c909fe7b3923199243fc276d9318ae85556c27661b8491ec9b3397418
Instruction Fuzzy Hash: 6031D2B28003489FCB01DFA9D895BEEBFF8EF96364F14444AD585EB601D734A840CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02EA7778 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02EA7807

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6f2dce04c50caf1b5d801c89b4cfacfb9973eb59aab374a6103ce8791ab647bc
Instruction ID: 3d751dac37722fa6adbd01b71f8901660b41676f4036613afc8d24ca79c45a49
Opcode Fuzzy Hash: 6f2dce04c50caf1b5d801c89b4cfacfb9973eb59aab374a6103ce8791ab647bc
Instruction Fuzzy Hash: 0221E6B59002489FDB10CFAAD984AEEFFF8EB48324F24841AE954A7310D774A954CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02EAC640 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02EAD7A9,00000800,00000000,00000000), ref: 02EAD9BA

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1910be1e8bf18ea894caef499122139813559a7d663dadb779804be51384f558
Instruction ID: be1811799fe91549b25e6b9f1266972fcd41024d082c350458fbed0d28dee997
Opcode Fuzzy Hash: 1910be1e8bf18ea894caef499122139813559a7d663dadb779804be51384f558
Instruction Fuzzy Hash: 3F213AB28043498FCB10CFAAC844ADEBBF4BF98314F14845AD559AB610C3B4A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02EA7780 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02EA7807

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1700b7507e8d137f53f1a2ba76510bb1de29d465b404ac04858fb07ca9fb24c3
Instruction ID: f0b4b038ca01e342cb7341679d925016c47f725b7c5b8df6afd1ec9bcae6b44f
Opcode Fuzzy Hash: 1700b7507e8d137f53f1a2ba76510bb1de29d465b404ac04858fb07ca9fb24c3
Instruction Fuzzy Hash: 3521C6B59002499FDB10CF9AD584AEEFBF8EB48324F14841AE914A7310D774A954CF65

Uniqueness

Uniqueness Score: -1.00%

Function 08F831A0 Relevance: 1.6, APIs: 1, Instructions: 61
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 08F83225

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7171fa6ed6b3fd8ebce05b9f20c5ace8304d7dfaf3a0f44238722b75c4847570
Instruction ID: 9801024daa12ba2222f84888da9f7722f1ab6e028f5fa8d2f879ccb4bd573e5b
Opcode Fuzzy Hash: 7171fa6ed6b3fd8ebce05b9f20c5ace8304d7dfaf3a0f44238722b75c4847570
Instruction Fuzzy Hash: D2215B75808389CFDB11CFA9C944BEABFF4EB59310F15849AD494A7291C378A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F84F24 Relevance: 1.6, APIs: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,08F87442,00000000,00000000,03EE42B4,02F2AEAC), ref: 08F87890

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 82324b094ca1923dbf7fb7f23e467df1cd33965b52233539b59164647fd72613
Instruction ID: 8288cc55f271203e902120c1e5021005699cb703cf89c1f8602b861204f016da
Opcode Fuzzy Hash: 82324b094ca1923dbf7fb7f23e467df1cd33965b52233539b59164647fd72613
Instruction Fuzzy Hash: D611F9B5C00209DFDB10DF9AD584BEEFBF8EB48321F20842AE558A3250D378A554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02EAC658 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02EAD7A9,00000800,00000000,00000000), ref: 02EAD9BA

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 73f40a68976691bab1ac49f4a37d1c1817e07cf3ebc6e7d364b152b95cfd80ea
Instruction ID: ce89045e77f1f93a961bc485d1fae742b1a519ee65388c3480fb14c7b25101d1
Opcode Fuzzy Hash: 73f40a68976691bab1ac49f4a37d1c1817e07cf3ebc6e7d364b152b95cfd80ea
Instruction Fuzzy Hash: 9F11D3B69002099FCB14CF9AD944AEEBBF8AB88324F14842AD559A7600C7B4A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08F84F3C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,00000000,?,?,?,08F874CF,00000000,03EE42B4,02F2AEAC,00000000,?), ref: 08F87AB5

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 29416517f78e2951d2eff5bdd01098f7a5aaca90ec218ba3415448bf848e73a6
Instruction ID: 1eda45a0440b75503b60d0af42197f9976e4af0bab9f22f0d4bbec1772d6f025
Opcode Fuzzy Hash: 29416517f78e2951d2eff5bdd01098f7a5aaca90ec218ba3415448bf848e73a6
Instruction Fuzzy Hash: 5011F9B1800349DFDB10DF9AD984BEEBBF8EB58314F14842AE559B3210D378A654CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02EAD948 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02EAD7A9,00000800,00000000,00000000), ref: 02EAD9BA

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8360a594d1a8fab58f1fe741bd9bff92f16c1634711a06527d73e99b09105081
Instruction ID: 0688dd478cd02fda32e75b65618698f5db561992bbfa26f2d4b0a3a09e7c4a85
Opcode Fuzzy Hash: 8360a594d1a8fab58f1fe741bd9bff92f16c1634711a06527d73e99b09105081
Instruction Fuzzy Hash: 661114B28002498FCB10CFAAD944BDEFBF8AB88324F14842ED559A7600C7B4A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08F87A48 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,00000000,?,?,?,08F874CF,00000000,03EE42B4,02F2AEAC,00000000,?), ref: 08F87AB5

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b840d15d40d18ff96816f6821ea03e9b5f286d90674fa4b799879ba86e609d16
Instruction ID: 5c9a66a4676f1f3269903cdce6371d322c70afa63627a152f63ebe9403c2103b
Opcode Fuzzy Hash: b840d15d40d18ff96816f6821ea03e9b5f286d90674fa4b799879ba86e609d16
Instruction Fuzzy Hash: F511F9B1800349DFDB10DF9AD544BDEFBF8EB58324F14842AE858A3251C378A554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08F87820 Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,08F87442,00000000,00000000,03EE42B4,02F2AEAC), ref: 08F87890

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 08f838a083f0510389d4f2b290d33b983caed99c17279a7f26a62363d7c9e566
Instruction ID: 16136fec73336e641002f31413384db19495cc52b96282dacf19455c7dc8e8aa
Opcode Fuzzy Hash: 08f838a083f0510389d4f2b290d33b983caed99c17279a7f26a62363d7c9e566
Instruction Fuzzy Hash: B211E4B5C00249DFDB10DF99D584BEEFBF8AB48320F24842AE558B3251D378A554CF65

Uniqueness

Uniqueness Score: -1.00%

Function 08F831C8 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 08F83225

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: eb3306e488c2527643819d61f0c9b8604250803ac06c80838dae1d49f8baf41e
Instruction ID: ebf38a87577b2a6bf6ccdfa89b5d11ed3e3e9f46d1365120a11207e12dcbb0fa
Opcode Fuzzy Hash: eb3306e488c2527643819d61f0c9b8604250803ac06c80838dae1d49f8baf41e
Instruction Fuzzy Hash: BB1125B1800349CFDB10DF9AC984BEEBBF8EB48320F20841AE554A3210D378A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02EAC804 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,02EAF900,?,?,?,?), ref: 02EAFD75

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 3ca859e1d8d1e1599e2a0c5d45ab01696e8f469237c24cd4ec502b883fdd54e2
Instruction ID: 05aa80dcbec378aac0789e9e39c5d4a6faff8b7d24aa8d951f87b5e3abfd0ee9
Opcode Fuzzy Hash: 3ca859e1d8d1e1599e2a0c5d45ab01696e8f469237c24cd4ec502b883fdd54e2
Instruction Fuzzy Hash: F91125B58002488FCB10CF9AD584BEEBBF8EB88324F20841AD918A7700C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02EAD6C8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02EAD72E

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c69ef520d7610e51e64bddc60e6d1c44e031862298c44bd688534c064a27fbb7
Instruction ID: 3f8c29ad7a6366deb9c7612518dfe29b885cc52d4b754f0c4677ae0bf492db1a
Opcode Fuzzy Hash: c69ef520d7610e51e64bddc60e6d1c44e031862298c44bd688534c064a27fbb7
Instruction Fuzzy Hash: C71113B5C003098FCB14CF9AC944ADEFBF8EF88324F10841AD419A7610C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F84F70 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,08F87587), ref: 08F8838D

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: cc0010b2cb5b422d61a5e5e1d75e03195269f53bf6fe5e6200d745666a3c1650
Instruction ID: 5f2ee51e76231c0cc29c8edfb7bc68cda39db1dbd7675d23ea4c9b7ebec08c61
Opcode Fuzzy Hash: cc0010b2cb5b422d61a5e5e1d75e03195269f53bf6fe5e6200d745666a3c1650
Instruction Fuzzy Hash: C811F2B1D10649CFCB20DFAAD544BDEBBF8EB48360F10842AD419B3200D378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 099289C0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 09928A25

Memory Dump Source

Source File: 00000000.00000002.1162350936.0000000009920000.00000040.00000800.00020000.00000000.sdmp, Offset: 09920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9920000_Firewall Security.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2ffd91e25e49eb26c6f1f14e182b966e636cbeaabcc9d9f1979f37e3bd4c774d
Instruction ID: f4b3d8811f93ae7ced1b38475cbfd2daabd6baaffdad163f108a4139038dc685
Opcode Fuzzy Hash: 2ffd91e25e49eb26c6f1f14e182b966e636cbeaabcc9d9f1979f37e3bd4c774d
Instruction Fuzzy Hash: D41106B5800349DFDB20CF99D585BEEBFF8EB58320F20845AE455A7210C7786545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09927FC8 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageA.USER32 ref: 0992802D

Memory Dump Source

Source File: 00000000.00000002.1162350936.0000000009920000.00000040.00000800.00020000.00000000.sdmp, Offset: 09920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9920000_Firewall Security.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 7169d81e035fbedf3a5889180ebcc55a4c7de08f07a0df12954b31638309c905
Instruction ID: ed40687d23ba9f3100575ac908cec9a11c3e07773674d2490d9951479c29b7b9
Opcode Fuzzy Hash: 7169d81e035fbedf3a5889180ebcc55a4c7de08f07a0df12954b31638309c905
Instruction Fuzzy Hash: F511F2B5C007488FCB20DF9AE944BDEBBF8EB48320F14841AE419B3600D778A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08F88328 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,08F87587), ref: 08F8838D

Memory Dump Source

Source File: 00000000.00000002.1162335262.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f80000_Firewall Security.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: ec1c8cd03c6ad0640c23156fe94d497710a11d27b23a1aafb3172849c9914083
Instruction ID: 1a0256fe11728fff9ae3b405755c69e41d452e78e2c14db03b1c95eabb06d3d8
Opcode Fuzzy Hash: ec1c8cd03c6ad0640c23156fe94d497710a11d27b23a1aafb3172849c9914083
Instruction Fuzzy Hash: A311F5B1C00649CFCB10DF9AD544BDEFBF8AB48324F14846AD458B3200D3786544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 099289C8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 09928A25

Memory Dump Source

Source File: 00000000.00000002.1162350936.0000000009920000.00000040.00000800.00020000.00000000.sdmp, Offset: 09920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9920000_Firewall Security.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 128a02f1fedd604935d14689d8a80b7dacf8c65cd68564a4f90b4119e7edfeeb
Instruction ID: 0e5428c5ce9cea2e7b74e1d5594010c38d0243a0be61a41227f4fa05fc2f682b
Opcode Fuzzy Hash: 128a02f1fedd604935d14689d8a80b7dacf8c65cd68564a4f90b4119e7edfeeb
Instruction Fuzzy Hash: B411E5B5800349DFDB20DF9AD984BDEBBF8EB58324F20841AE558A7600C774A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 09927FD0 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageA.USER32 ref: 0992802D

Memory Dump Source

Source File: 00000000.00000002.1162350936.0000000009920000.00000040.00000800.00020000.00000000.sdmp, Offset: 09920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9920000_Firewall Security.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 48a8af3cb30530bde0816e1f9296c991185d47ec510ad6f2e2dda8c6126e4d37
Instruction ID: 441deeb2de7ca2a3a5053c7f91b0d47f521b3ed383730432963ac93bc77a2392
Opcode Fuzzy Hash: 48a8af3cb30530bde0816e1f9296c991185d47ec510ad6f2e2dda8c6126e4d37
Instruction Fuzzy Hash: FF11D0B1C007498FCB20DF9AE544BDEFBF8EB48324F24841AD459A3610D778A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0125D210 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161644774.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c8b72ddba3cd4e3dfc3f9115f4c643b775b85fdbcc2ffdfc7a7fa1015ec70b
Instruction ID: e7d5d8b367a1d23b30379318d2cacc8c51f3bc45c2500cb32a35eca2f898acfb
Opcode Fuzzy Hash: 80c8b72ddba3cd4e3dfc3f9115f4c643b775b85fdbcc2ffdfc7a7fa1015ec70b
Instruction Fuzzy Hash: D8214871114244EFDB41CF98D8C0B26BF65FB88360F20C569ED048B207C376D456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0125D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161644774.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4185259a96e32d1f20c97cfe4c8627b874a03380a7764c4cc823e0036727c9b
Instruction ID: 9acd6334d76ee1a7919002e8f23a32cb2526328c810f48a7e39ea3f05a121574
Opcode Fuzzy Hash: d4185259a96e32d1f20c97cfe4c8627b874a03380a7764c4cc823e0036727c9b
Instruction Fuzzy Hash: 6B213776614249DFDB45CF98E9C0F26BFA5FB8832CF248169ED054B206C336D446CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0126D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161657364.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8638dd8be496328d8e0ec03b98b5c8032a85ac5024b86663485a388fb7206101
Instruction ID: baa0ba2349d8b80dda9f049d45b1fb07c348cfa03ec72d387c2a07c927c0b8f0
Opcode Fuzzy Hash: 8638dd8be496328d8e0ec03b98b5c8032a85ac5024b86663485a388fb7206101
Instruction Fuzzy Hash: 4D21077571424CEFDB01DF98D9C0B26BBA9FB84324F24C56DE9894B283C376D486CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0126D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161657364.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d4f5b5617dcf2a04ecafcdf43624576a78d070eb20116a5467f44f1ed4a851
Instruction ID: 1907adca69f7b3f9c5e287189f6d4cdab53247dbd67cff92d38ce0d9963bf601
Opcode Fuzzy Hash: 38d4f5b5617dcf2a04ecafcdf43624576a78d070eb20116a5467f44f1ed4a851
Instruction Fuzzy Hash: DD21377531424CDFDB11CF58D8C0B26BF69EB84354F24C569E9894B282C37BD487CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0125D20B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161644774.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb886a2089afa14be6593cf5177590eae9d70dcf9b880adc46b1fa24b51e0801
Instruction ID: 67fbd72651d056c368d332f5b2ee6d4bcbe70a777fe908dff6d9c709e9ce8af8
Opcode Fuzzy Hash: eb886a2089afa14be6593cf5177590eae9d70dcf9b880adc46b1fa24b51e0801
Instruction Fuzzy Hash: 8021CD76404284DFDB02CF54D9C4B16BF61FB88320F24C5A9DD084A617C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0125D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161644774.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6b5baabe9335c76f8349eb3891d6fd96e133866cef17f038124af8d9c691a2
Instruction ID: ab3c8f6c9b1cb28b55aa70d4ffc1a3bbbd6c3fc28a622a1c90d5e00e437efed5
Opcode Fuzzy Hash: df6b5baabe9335c76f8349eb3891d6fd96e133866cef17f038124af8d9c691a2
Instruction Fuzzy Hash: 79110372404244CFDB12CF44E9C0B16BF71FB84328F24C6A9DD094B216C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0126D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161657364.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ca659f4e1cb75c9d23ca67791a5ff3406791c233829be1ecb41106f2d24afc
Instruction ID: 852652daf3ac3bd78035e8b5776bc8487d241a3264678dffda76fc50fc020fba
Opcode Fuzzy Hash: a5ca659f4e1cb75c9d23ca67791a5ff3406791c233829be1ecb41106f2d24afc
Instruction Fuzzy Hash: 4E11BE75604288DFDB12CF14D5C4B15BB61FB84314F24C6A9D9494B696C33AD48ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0126D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161657364.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ca659f4e1cb75c9d23ca67791a5ff3406791c233829be1ecb41106f2d24afc
Instruction ID: 2f3b64d72c2baeb5802fed5ec378a25f6698e31c7109cc9f50725e90e9e19079
Opcode Fuzzy Hash: a5ca659f4e1cb75c9d23ca67791a5ff3406791c233829be1ecb41106f2d24afc
Instruction Fuzzy Hash: 5911BE75604248DFDB12CF54D5C0B15BB61FB84224F28C6A9D9494B697C33AD48ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0125D749 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161644774.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bcc96fd96fb1fa8d931280f04bd8cf1d7929dc2ba28865c31907dc2d79cbe07
Instruction ID: 5597695e3327076e366fa99692d9639b881f1f3df2a1933d5ae5f19d6ab17d4a
Opcode Fuzzy Hash: 5bcc96fd96fb1fa8d931280f04bd8cf1d7929dc2ba28865c31907dc2d79cbe07
Instruction Fuzzy Hash: 9001F271014388EEE7649A59CCC4B66BF9CEF45630F18851AEE080A282C27A9840CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 0125D6E7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161644774.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1bb79f44d135b83b3e7b819b9082311f216bd1e07bfcc6fb0c2541047a3601
Instruction ID: b3e016d89a4e17b00e0bcb23ab6c716fee31bbc08a04bbf7e4faf948e0128129
Opcode Fuzzy Hash: ce1bb79f44d135b83b3e7b819b9082311f216bd1e07bfcc6fb0c2541047a3601
Instruction Fuzzy Hash: F0F0F976200644AF97648F0AD985C23FBADEBD4674319C55AED494B712C671EC41CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0125D748 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161644774.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91871433d523bd272d0e0d8a70b653ab9c8493ce680b8944220957eeff1c83a7
Instruction ID: 473b731af10c99013d7d3eff9ef8d7c270fb26f4fd877ad7fcda286740d9eb23
Opcode Fuzzy Hash: 91871433d523bd272d0e0d8a70b653ab9c8493ce680b8944220957eeff1c83a7
Instruction Fuzzy Hash: 0CF0C271004384EEE7248A0ACCC4B62FFACEB40634F28C05AED084A282C2789844CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 0125D6D8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161644774.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9548e6b4f1418ff39dcf0ed4a6fc30d304d0fefe91c1198bf3b04c24d5151fab
Instruction ID: c496e71c9674de5e1a37524d79f9d4c83e4fe64934fd80203827c7546664ca83
Opcode Fuzzy Hash: 9548e6b4f1418ff39dcf0ed4a6fc30d304d0fefe91c1198bf3b04c24d5151fab
Instruction Fuzzy Hash: CAF03775104680AFD3698F06C984C22BFB9EB8A6607198489E8894B322C670FC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 09928BD0 Relevance: 7.6, APIs: 5, Instructions: 114keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 09928C2D
GetKeyState.USER32(00000002), ref: 09928C72
GetKeyState.USER32(00000004), ref: 09928CB7
GetKeyState.USER32(00000005), ref: 09928CFC
GetKeyState.USER32(00000006), ref: 09928D41

Memory Dump Source

Source File: 00000000.00000002.1162350936.0000000009920000.00000040.00000800.00020000.00000000.sdmp, Offset: 09920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9920000_Firewall Security.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 3ebddf0c4d6f8c7fdf63edad42885d51932654fd65687f239a9ccf8f9a5a17db
Instruction ID: b7576e59810182a57073409eb3c436a0263566312db2f6a5dc41ef3cdead2ee3
Opcode Fuzzy Hash: 3ebddf0c4d6f8c7fdf63edad42885d51932654fd65687f239a9ccf8f9a5a17db
Instruction Fuzzy Hash: 6941A4758017958FDB21DFAAC5487AFBFF8AB54305F24840EE049BB280C7B9514ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 09920310 Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

fff?, xrefs: 09920987

Memory Dump Source

Source File: 00000000.00000002.1162350936.0000000009920000.00000040.00000800.00020000.00000000.sdmp, Offset: 09920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9920000_Firewall Security.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: be7b8049ef9994046957a0488906a00d206a90e532b0c9417db35d860769631b
Instruction ID: 410ec7d6e05ff87907871d048b4f82a9f99589ad9be25e5441b59f0813edfade
Opcode Fuzzy Hash: be7b8049ef9994046957a0488906a00d206a90e532b0c9417db35d860769631b
Instruction Fuzzy Hash: 49122A35800619DFCF11DF50C888AE9BBB2FF49304F1585D5E9096F265EB72AA96CF80

Uniqueness

Uniqueness Score: -1.00%

Function 02EADBD0 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2275b7248b8fd0495385762fc9a28c4d5339b5f306a8479e25d1d746a73d5e
Instruction ID: 34e306d5faba95ef4a396b5b61aa8df3b512b1024a5507886ce20643405643e0
Opcode Fuzzy Hash: 3c2275b7248b8fd0495385762fc9a28c4d5339b5f306a8479e25d1d746a73d5e
Instruction Fuzzy Hash: 585235B05217458BD714CF28E89A6997FB9FB41318FD0C22DE1A16F2E0DBB4644ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 02EAC444 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1161724704.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ea0000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60428fed8a75e58490826913203cf65affa15773d311919b4e7dddc187a4258c
Instruction ID: 7aac0506ffff783b32604c749f9742b0800227c5104091002fe5cf02e9db1a90
Opcode Fuzzy Hash: 60428fed8a75e58490826913203cf65affa15773d311919b4e7dddc187a4258c
Instruction Fuzzy Hash: D7A16D32A402198FCF15DFB5C8545AEBBB2FF85304B25A56AE805AF261DB31E905CF80

Uniqueness

Uniqueness Score: -1.00%

Function 09926590 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1162350936.0000000009920000.00000040.00000800.00020000.00000000.sdmp, Offset: 09920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9920000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55e5b333e688e087c9b8c2537f4df274da04251297fa9187868512f6e2d2b96
Instruction ID: 30db9f876221c24a49c563b91e65db9bb947f3c545f12c25eafac1a9f32c2699
Opcode Fuzzy Hash: c55e5b333e688e087c9b8c2537f4df274da04251297fa9187868512f6e2d2b96
Instruction Fuzzy Hash: 1381C276D00609DBCB14DFA9DC452EDFBB2FF94350F14C13AD415A6688EB359A1ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 09926038 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1162350936.0000000009920000.00000040.00000800.00020000.00000000.sdmp, Offset: 09920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9920000_Firewall Security.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da12e668bee108e42ff7f912e4f0ccd2af91f3bad37ff2af1c8da0e76eebd8d
Instruction ID: ccef3378a299391a04c72d01c7478acfcfd65ab0ed5e5fb2bd4ca4dc85812e46
Opcode Fuzzy Hash: 5da12e668bee108e42ff7f912e4f0ccd2af91f3bad37ff2af1c8da0e76eebd8d
Instruction Fuzzy Hash: 4F81BE76D006098BCB04CFA9DC492EEFBB2FF94350F14C13AE415AB689EB358956CB41

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Firewall Security.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Firewall Security.exePID: 7556, Parent PID: 3000

General

File Activities

File Opened

File Created

File Read

File Attributes Queried

Volume Information Queried

Device IO

Windows Analysis Report
Firewall Security.exe

Function 08F8A038 Relevance: 2.8, Strings: 2, Instructions: 267
COMMON

Function 09920320 Relevance: 1.9, Strings: 1, Instructions: 693
COMMON

Function 02EAD4C8 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Function 02EAC7CC Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 02EAF6C4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 02EAC778 Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Function 02EA7778 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 02EAC640 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Function 02EA7780 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 08F831A0 Relevance: 1.6, APIs: 1, Instructions: 61
windowCOMMON