Windows Analysis Report
file.exe

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00AB8970 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00407D20 appears 55 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.RegAsm.exe.436060.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 2.2.RegAsm.exe.4b3c60.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 3.0.DMINktnUtY.exe.cc0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 4.0.J48w21dBmF.exe.740000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000002.00000002.1681601241.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: file.exe

Static PE information: Section: .data ZLIB complexity 0.9957952789319011

Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, kU5tliBImvaQ8ijXHBH.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, ior9Akd5ddZSi4JUE3I.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, ior9Akd5ddZSi4JUE3I.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, RsBNpMSIA1NJTZGGM59.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, EvIl806iCqlrVic9EL7.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, ymPuo7hNqu7rH1NPowv.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, ymPuo7hNqu7rH1NPowv.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, Strings.cs	Base64 encoded string: 'GVcsCi8lPCw0QAVDNVUzPBcKbB83HS8CNTEjNxEnMFMEQiM7MB8sChAfJCcqNSMgNj03HSEZEhAwJEVO'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, Strings.cs	Base64 encoded string: 'NjIdFQUMAg8GNFcvNyY4HgIkJBEaJjgUDg0NVxslKFc3UzQgBjQeCQUbOB4AJwoTNSYaKBgbKA0HNV5a'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@10/4@1/0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\DMINktnUtY.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7488:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\DMINktnUtY.exe "C:\Users\user\AppData\Roaming\DMINktnUtY.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\J48w21dBmF.exe "C:\Users\user\AppData\Roaming\J48w21dBmF.exe"
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\DMINktnUtY.exe "C:\Users\user\AppData\Roaming\DMINktnUtY.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\J48w21dBmF.exe "C:\Users\user\AppData\Roaming\J48w21dBmF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

.NET source code contains method to dynamically call methods (often used by packers)

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1464832 > 1048576

Source: file.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x134600

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, ior9Akd5ddZSi4JUE3I.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{YYtS09hfE44Dgdn6eP6(typeof(IntPtr).TypeHandle),typeof(Type)})
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, ymPuo7hNqu7rH1NPowv.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{ekkVyRtJMvVSoctoUmo(typeof(IntPtr).TypeHandle),typeof(Type)})

Source: DMINktnUtY.exe.2.dr

Static PE information: 0xEB89CB14 [Tue Mar 22 23:49:40 2095 UTC]

Source: file.exe

Static PE information: section name: .zzZ

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB8115 push ecx; ret	0_2_00AB8128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00428E7D push esi; ret	2_2_00428E86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004076D3 push ecx; ret	2_2_004076E6
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Code function: 4_2_051536FB push ecx; retf	4_2_051536FC
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Code function: 4_2_05155A40 pushfd ; iretd	4_2_05155A49

Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, Strings.cs	High entropy of concatenated method names: 'Init', 'Decrypt', 'Get', 'SW7XlrLiUtWtnAPuFtV', 'gyNMMlLMaRRJZVA8Zga', 'syvAAsLSYSns17kCQ5l', 'uoNmVrLh7m9eQTQYps9', 'NweWaRL2PB9sh4II1Mv', 'tWLdQsLOBsFU6dULcLx', 'BmavqDL0KlWIly2fF0m'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, Uv6YUiUwiQlDKPLBKM.cs	High entropy of concatenated method names: 'oLBfmLT9Ns', 'GomfrRgoqL', 'IDTf9oF32T', 'htnfzOZWFw', 'gcrDcvOcXR', 'FVQDjt0k05', 'DseDu7FOUI', 'mKXNW2MpLBiURKss36f', 'yrJ9qyMZn4AGtbXbRmy', 'YG5D7PsP0l'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, kU5tliBImvaQ8ijXHBH.cs	High entropy of concatenated method names: 'ENaBSnTU1B', 'qATBhpGvvj', 'So3BOCaM1G', 'lusBkeD34a', 'nKhBaiF9lU', 'XMYB8Kr8g0', 'm21B5VgJPV', 'rJyBg516vu', 'wMMBbJ4gGv', 'o3DBLjrrPH'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, fFbZwlX6ufedP3VVdMU.cs	High entropy of concatenated method names: 'T8AXE6QJcl', 'PqTXVvxFFR', 'FT8X3mstF7', 'dINXUPmirf', 'd79Xv913rb', 'aOdu0hsMnOTcuTXEmyZ', 'ax8DabsSZaBB4wDSxjR', 'd87FcWsiiHfIY3bAgvj', 'wdia52sLpfwFS8sbo9O', 'CFr89Zs1cE4IO3gDp0m'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, OawTOsXok9dLIGUygKV.cs	High entropy of concatenated method names: 'wguXwrkVYN', 'M18XYmqCaV', 'IeXXITOoen', 'iFHXsbDTkd', 'Ly9Xb2eD0U', 'Mo9XLmnBFS', 'XD9X1XKkSC', 'DkJXMI13AW', 'Dh1XSEVscu', 'TyeXiNy2ho'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, gWZbR7uUo3Ecmavde4A.cs	High entropy of concatenated method names: 'PxZutvKsUo', 'atGuFpZi5w', 'hVvuqZaPyc', 'FvJunRVQED', 'RkDuo2sZUm', 'qyguW9EbFq', 'h1Jufy2HhS', 'Ud1uD0xNYq', 'h8auTW89UE', 'LieudcDK10'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, LAmgpAMJb2FSRsQu6M.cs	High entropy of concatenated method names: 'Field1', 'vbdDjbY8DHesv4vMlbr', 'ySTYUcYGBhEEbwjBjoA', 'DGDHkqY5GmAedjA9rtO', 'qS4qC3Yg4YVNc2ih286', 'zDRZsSYK7tomF32MpxA', 'GmheqfYQhhLKAbILsd3', 'AIRZ0kYasBsVaTidhA9'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, GTUJybuyb8qluZH6i7u.cs	High entropy of concatenated method names: 'D8burCwhun', 'k3Pu9vMvoh', 'Dispose', 'va5uzN0G6r', 'idgGZbs45KVbGmhOslP', 'CT37LyslFBUQsgaHYao', 's5hCBwstxBAmqJ5rwnN', 'GB3WsLsPlYBfJifTq2c', 'oYAL6msFGFhXb89fJu3'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, VGSE25XrYZJ1Kcb1FkT.cs	High entropy of concatenated method names: 'sxsXzROfXo', 'mDu7csjce6', 'Trx7jS1097', 'p8W7ucG7hK', 'IW57XK0iJI', 'XqD77RQKWn', 'PLt7BriMAb', 'wrq7HaZwYY', 'rjM7eYvTMK', 'lKI76bjIxt'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, kZrCypXugJuhBYjNYsQ.cs	High entropy of concatenated method names: 'cnfXBaVqTM', 'Ex3X7koON5', 'Xdr0ZRsxo8SnAZKT8ex', 'FCYeLBsoVmZUo0s9SfY', 'Nd39M5sW5HCVAq1ksFP', 'Kdarb7swNPtnuAwPT5p', 'CGVlu3sYgVotCauIRjk', 'yOCNDosI2YClmmPS4gH', 'hjjpuBss62PZd2bJx9B', 'WUkekWsqL0q1wZxJ7mX'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, IHXC94YXWFClKfVysr.cs	High entropy of concatenated method names: 'TgQsedPD0', 'Mosbcbnbh', 'C6jL72jyy', 'I\u04344', 'XDNyPHYMM3F0XLUMcaU', 'WsGq7IYSXsg8QKfp3dp', 'PvPPojYiJ8nfwmrifFt', 'rXar4lYhpYFDSirtGBP', 'sc7lcTY2ywa2TQ6NuPd', 'GhZJLAYOGXMqjUumvlM'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, mWn2uTXfABRTA9gvJpL.cs	High entropy of concatenated method names: 'vIPXTPbiHE', 'Y2oXdbqFYx', 'MgRXRHWLG9', 'uBUXJKE8vn', 'LOTX4C1EqN', 'kWRXlr11Fh', 'rnfXtVIjAE', 'YcFXP5Vhrc', 'VlHXFvNsEc', 'eiTXAJKJmf'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, SyxKifekd28kxBNqQqx.cs	High entropy of concatenated method names: 'YN8dsVrSIj', 'RU6cEqiX5QgF0tko90y', 'UDHrY4i738uKB2LNpv7', 'INJxuYiB951gZhacsRN', 'Yu4dL6TqLq', 'fBDd1an2gj', 'a34dMsYUke', 'MSXdS0iJav', 'WX9VMvieHIjYRgo3JC5', 'LOWQ83i6oc0PgAgZiXa'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, hmpfoCjvg4hqsFP0LjP.cs	High entropy of concatenated method names: 'zqZToFyuAq', 'yZnTWTUmx2', 'w6Ke6MSt5X64q3us6AB', 'SNWnVqSPbaWEOi19otP', 'TudkPFSF0j9tpnlLnIm', 'wOqEBPSq1RrJhiw9NZZ', 'DHqnrJSnEPSTn6QEnQe', 'G06TIkdJJT', 'J2AKG6SoUaiRRlOdTE4', 'Q0EBytSWLONhTf6Ngkb'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, UtoRl5uKb9Fp7h6R4GX.cs	High entropy of concatenated method names: 'qqsTaE1Kd4', 'JFT3e1Sa09e5ForaSx7', 'yWh9ddS8fvVek9GibGu', 'CDruZ2INIZ', 'xdbuNPYrWZ', 'u55JW2sDJreFKL0aOEW', 'LfFYNasTMxN2pbTNPyk', 'lEcpIHsdX0RViQjS4X3', 'ldAqc0sRN5Is49aM0Wr'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, DJTcgV7fSIieAeqHgA0.cs	High entropy of concatenated method names: 'jt543GErCe', 'W3r4USIhU8', 'KYn4EQQiGT', 'na74v95gdW', 'E3k4f3mExU', 'Ix34DsZaLf', 'Ob94T23cie', 'tMD4dl9KQh', 'hyt7T6hnHo', 'U4V4R7McRE'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, SkL3LGHeejS7o6KAb0B.cs	High entropy of concatenated method names: 'BVkHC3dpCK', 'LwOHV8KlEn', 'sB2H3eb6A1', 'TDrHUfDXNx', 'dyqHvKO0fC', 'RGZHf44N66', 'Fk8HDKQoT1', 'X6IHTQmFp3', 'OLmHdkZrHR', 'UltHRusjRv'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, q9oNCQ3LukRHjfJdSTn.cs	High entropy of concatenated method names: 'c7j3MPyune', 'gLJ3SMxcXC', 'KGX3hm1pLD', 'oKv32ycjs1', 'cQj30nect3', 'Eox3Q0Qemp', 'C9p3aPl5s1', 'ToString', 'gFCTclMlI2t0jthLBHA', 'DHIqVrMtW3DA82BJgk4'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, uwnKjGF06wYI5Nb9kX.cs	High entropy of concatenated method names: 'Field1', 'hjyqMrTso', 'Field2', 'Field3', 'QTcnZLsMC', 'VrxxFFebR', 'IG9o5pFLF', 'rRuWXPYAN4NRB3yykmS', 'C1CBtYYqVKVt3DlngCD', 'Mh7QX2YPcLclddWJlZ7'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, LrFTpY7iUXI47XuL87C.cs	High entropy of concatenated method names: 'jt543GErCe', 'dD944UjqUM', 'Vwy724cqDJ', 'iTs7OR04P9', 'AWX70R6edo', 'Jk07kRZIgf', 'qmh7Q8DXhP', 'KYn4EQQiGT', 'W3r4USIhU8', 'kDO4lnWoY1'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, ior9Akd5ddZSi4JUE3I.cs	High entropy of concatenated method names: 'hEOCU7hWD8mjKfipxt7', 'MxBfikhwhN3ZGOjYMed', 'srQJ4tvwkf', 'cUaCX9hbaGAcxyqube5', 'NDE0gahLlVvO4PiMDwb', 'dhgUeUh1uSEJhGs0GMW', 'Q3RJfVhMSkAgEi3kLH0', 'snyhUahSAZWer9Hi99X', 'g38PJ8K3c0', 'korJn9sVu4'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, dWsk2suC6DIcKHHbQrw.cs	High entropy of concatenated method names: 'ExpandEnvironmentVariable', 'j5quVNpYfo', 'b4Uu3r0uip', 'HP2eMvIypBAMvbdafSK', 'BUUvTZIm87YYpjgFyVd', 'G7FcPXIrP2If1e4e5rO', 'wypZ9WI951lHn1XIn2h', 'AMgnc5IzGmxR5mPTpEQ', 'gJn5J7scObuOBLKLmWq'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, AGCC1qjaZnIu24AH3bt.cs	High entropy of concatenated method names: 'J28uc9oq4Q', 'cL8jGTwbHJ', 'uaIj5It8WI', 'DAfjgD2kUN', 'XP0jKjQj02', 'QubjpLKfRY', 'pm1jZrrVHS', 'mgUjNfux08', 'zxajy2Mhao', 'NxIjmwTHvn'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, cnM5KpB9Si7YRITptjy.cs	High entropy of concatenated method names: 'nb6Hc2ZIfx', 'CiEHjWUS0G', 'dIOHudqMg3', 'z1jHXYvPwI', 'SJSH7klKfW', 'Ce28quLcvR3ePOS1vwW', 'Fhn3wWLjimtpHhSkrih', 'LPQC5DLuIKtTL6HAMsD', 'RANFXYLXEqyiwsHhWbQ'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, zgHUwGHNI1chR8xhv4v.cs	High entropy of concatenated method names: 'vPFdoIb660', 'GC4dW2P2cY', 'JqPPI2S9I1aALueYFRs', 'mnTkbrSzGCki1QonSM2', 'fdeMYCicWgi14v1w47F', 'IGTPAlijB4EOU9emPMK', 'wwYHmJqSlU', 'fLXHrXKglT', 'dsBH9msXjp', 'yAgA8qLIkxsJjLaQabN'
Source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, X5iBUftytZuo7rW1lJ.cs	High entropy of concatenated method names: 'Field1', 'Field2', 'Field3', 'zDEAfxYf60yVfYmhRvB', 'RHKd3bYDFFwx4jZ6e2R', 'nxf7i4YTgrRvbQZE50r', 'ImeXrHYdkppaCTrFegj', 'rRYWxdYREeaSJPOg2qD', 'El1TWVYJTw7cBuSVEXm', 'xy4h9CY4yGwlbXMloxx'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, MI9HRSOvwZeUK3VMWUm.cs	High entropy of concatenated method names: 'XOV0JT40t6', 'S3vO3m9uVf', 'lITONJBd7h', 'qfoO5LUYma', 'kVMO1CEX7T', 'VUrOIm3Qe0', 'zb9OMY15M4', 'wgcOGZ5nwc', 'btBObjfDOs', 'lfWO7kI64e'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, UAFCoqEm5t2t628Rj6.cs	High entropy of concatenated method names: 'Field1', 'Field2', 'Field3', 'YqBkX1iv89WPRoZ0KM7', 'tOAjcmijKbAwKRZOEF8', 'ObIRZbi35BpjIcfeVOT', 'dECfuMiNjUcGcnHFQ4C', 'XhxfQ9i5pfNRIwaCcq2', 'ej4sbxiVU8nLjyuEq6W', 'KCOGO5iEcB6WwTBV2QZ'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, IRxSG6qt0JkYwKh1cA1.cs	High entropy of concatenated method names: 'm6CqvvqbXE', 'NFPqV2WPSM', 'CjXqEkbwJ7', 'EX13R0CKHPRgghmyZ57', 'oIn5JWCzrb8BfPFNrij', 'K1dM6PwJmFq8lTrvnL5', 'vCmpHDwOQ5JVPsAWIGn', 'KBtg2lw0IK1U9N6lhsV', 'XHwKVmwsFQFhiov5n26'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, x4QOh80pVtb236KIyss.cs	High entropy of concatenated method names: 'KYd0Z3Dffe', 'zyn0x7m082', 'LgX0e4cslF', 'HQD0PEU9KR', 'sH20yHT1fA', 'zFU0u0apw2', 'fax0DR3qlS', 'xJA0ce8nCb', 'tlE0A2B9K3', 'W0B0h2cZkh'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, svBIiPpoOPB51PVt4u.cs	High entropy of concatenated method names: 'ECdD7lsjFc', 'StpDYnKHya', 'pLCDKa2Phd', 'PFiDzqXTG5', 'iA2cJWX11O', 'YHhcOdliie', 'XDSc0mEwCW', 'UEhKNWWjIlKKkrnFk9k', 'BAj3vTW3jQrwsrkqlEH', 'Field1'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, IySwrSs0IOLUMRVYwiw.cs	High entropy of concatenated method names: 'G2Os6cplpi', 'KsnsUZRZmp', 'poM7WTg29bEDyfMmkI0', 'sJcFN7gWK1BaNeoVguL', 'laesU4gkH0xqOFQywS8', 'UH4ImKg9mF64DdgkiQ7', 'ib32oigtLFxiVhrVG7H', 'PfN6nmg87dp2i75I9dx', 'aYMriWgV4xn3aF3sBac', 'LOfaBtgErGkSVc90pgQ'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, RlBF8Yl8Mnqswvfy6T.cs	High entropy of concatenated method names: 'ObpFUuDsX', 'qSlgsu09H', 'DI7d5XObG', 'I\u04344', 'YG8nAuis3Gfeu0gcIEA', 'zty0ZGiU0TvxlVce1Lt', 'prXVsFi6dbVUo65JnX8', 'MMm5Kciq3LOQrX3tWdB', 'gvvQKmiH5SlJNxgI9CC', 'Un5Y4tiXCTTvxS6Oq1Y'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, s6ECEhpmkusi0Qv5kY0.cs	High entropy of concatenated method names: 'z88pDarpDl', 'z0hpACi43S', 'AJvp40rrEV', 'nylpSKeLNo', 'fwnppgyNHT', 'rjXpBJNORc', 'k5AcsEWQZ6dEHyVcNB7', 'tfsBeLWeqEMcGXExYR7', 'huC179WofcMXsHx0maD', 'WZB071Wx6ICnsKgQXte'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, RamrfvUW8b4LOT78xRN.cs	High entropy of concatenated method names: 'inlnSs5o2E', 'aFRnn0WNmS', 'nmcU9QMh4h', 'D0jUtK8e9Z', 'CAdU8YqWcM', 'bR3UVkb2ah', 'scSUEWLZXO', 'SPinmyoBYJ', 'ITPnpCntwG', 'UnynTWIRZh'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, ywXCBSsXL20GxCBwtB4.cs	High entropy of concatenated method names: 'WGIA7pXqls', 'bM6AYyD5eA', 'BHWRf3kIwneTDcINIsb', 'lim8qDkMusJMyNYtL4L', 'puGxYVkGpSVPlZ938f7', 'BChsm5DupI', 'iTJsrO1qgZ', 'ggssSgv0DB', 'R8GspFYU51', 'v1vsBqB1WQ'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, iycOc4OBrCIqcimjTAQ.cs	High entropy of concatenated method names: 'VNJAypw7OG', 'qJiAusskyB', 'uy18Ytkhisf2ExTJW1J', 'n3nvUFk4OosKZo4bCnA', 'o9Ux5fkndnCLoYNQFhn', 'CvI3xykTow12KjcAvLx', 'UlAAi6V5CM', 'R2hn1lkoAcrBZOQsvLb', 'CKV74pkxarYvZMXr0MZ', 'VmApTLkeC243cc92203'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, u0NXHu0bkvMRgbfSJy8.cs	High entropy of concatenated method names: 'hgYAMdmK0g', 'M8fGurk3eZ1FFnYRI5U', 'NGqB8DkNlLEpOAMjIdq', 'iUsDmtk5WwBGjhj4PBr', 'vbo0Y17V2X', 'aMX0KbUph3', 'Dispose', 'rb80zO43DU', 'Q0pvd0gLxuGFYco0pN4', 'rR1KPygn8JrTspKJlEp'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, rKvsa3syrS73YeA7jyA.cs	High entropy of concatenated method names: 'F1msaJHgRl', 'AYpslkP5a2', 'n6DsiA7tnZ', 'cXlsFQYH2M', 'c9JsgWaU7y', 'RxZsdTg57w', 'hJBsCoCt0O', 'aduswwBmWf', 'Qt7s2vb2FY', 'mZ7sWobLdG'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, ASIA32GE8WnZlNuPFd.cs	High entropy of concatenated method names: 'AmxAPiyHXf', 'EAWYjBkBJd2GPPQeYy6', 'uS6jlEkDPSKUyhYrhW5', 'zlWhKXkcbEUjNDYpCeE', 'Field2', 'Field3', 'L5K7X4GXU', 'off206F04Lyl7CYs3xx', 'RDqLtOFJFt63rZo8nmD', 'fuE2WfFOx1XZOnj8trm'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, rSDSpq6PNmQKVcpcMNZ.cs	High entropy of concatenated method names: 'nCe6yn3XSf', 'ryC6uTKVnP', 'Qq86adOyQv', 'Tmh6lG8APu', 'hiIJhiCfZHOG3Tqtuj7', 'cIyvZqCmi469eHl14Hr', 'nQkrrICr0hJuZDFQZjv', 'oXdU7rCS8hhC3yGPtqc', 'LaRnqQCHWJ2OGsK2Bfp', 'zfaPCWCX0gbZZA0KZjv'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, gesyyeL87s3PHycCwjB.cs	High entropy of concatenated method names: 'gfSLbNeAbF', 'LCML7PG00q', 'FHcLY3S5QT', 'eVeLKxmD1W', 'bHeLz7hKNq', 'aKOnJNM6Nk', 'TLFnOoPsAI', 'rC8n0UOcIQ', 'lDcnslAAF4', 'HrSnUgr0kd'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, Vjy70LqGwwWppi5TZNJ.cs	High entropy of concatenated method names: 'hoLhylep9E', 'LWIhuUiHS8', 'SDSKSxk7PIpNHQwjjGW', 'tPh0hSkYr9sqNTtnwuZ', 'CGamJgkKFB2uaMWkP3c', 'KchWIykz1IdHLFwkjmw', 'iZrK3c9Jffj7ahtDWPe', 'NpJ3GW9Ooy7UJMXZI8K', 'CRb2f190Z79p3eyfnFd', 'asrbLg9sxmhFIivRY6h'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, oXutQK0fHr1rqG4SV0v.cs	High entropy of concatenated method names: 'ExpandEnvironmentVariable', 'WAp0r7xB9F', 'sDa0SlWmQ9', 'OMnZmCFIxKFkpSD6bLn', 'ONtDvZFM5hd1AbanMeU', 'euyBq6FGBestpSSCiVx', 'AHcHL4Fb7oGTcdEeZiW', 'KNO7dmF7lBjgiBgJ5M8', 'UyTcFcFYut9VLjoxExr'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, UEdYIrZeVJVB5DkBei.cs	High entropy of concatenated method names: 'Field1', 'Field2', 'Field3', 'xeENITlioHIS6jx5fS6', 'cVhSIMlFHMlZXDghyP2', 'exlNxIlg4cxfDXLCnph', 'GcjOX1ldVoEWIXgZtWG', 'vmbugalCWfHO5EVpgXp', 'O7hmcTlwmpXbfF9W1w6', 's58uxvl2uk4hmIWiRRF'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, XF74h1wZjOuXiQCriF.cs	High entropy of concatenated method names: 'Field1', 'KcYEWoioxRmXbg14ZTg', 'M0g4MJixxeWvfq06X6v', 'h7W86RiQYxEQfQyceC2', 'HJTrZKieIQDUiZVx0sV', 'fNvMGUiPToCS3pwmf9Z', 'qIEHRBiRUbneLEsKkoQ', 'hC4NVXiyqEGBQbfb4n4', 'cE1k67iTKwDtVQn6dD2', 'm7ji8qiZ4rMEx5EuwD9'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, EvIl806iCqlrVic9EL7.cs	High entropy of concatenated method names: 'M0H62wkQxa', 'kVP6kf3p9p', 'Tg66tnnwQA', 'Mk26VYfoxj', 'owJ6vab0RD', 'gDC6jaPI0c', 'yg26NWt2nn', 'Eyo65wv3LO', 'KsB6gDmZNP', 'DES6dul3E7'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, cBNyi2sYfgL3550bGU3.cs	High entropy of concatenated method names: 'RM5szeEQ1t', 'lXNUJr8S5h', 'XBEUOrC4na', 'BLiU0lb5ax', 'vbXUsIuYeN', 'Yd5UU0tqGG', 'YrKU6dHILU', 'sAaUqov7q3', 'ouQUHEZBRs', 'J72UXJwyCt'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, nsSneXq3eaD03mDbw7B.cs	High entropy of concatenated method names: 'HX6q5uO1hq', 'ERMq1W3NeI', 'hSaqIwS2Bm', 'DVPqMuYeZA', 'glPijjwHTjK1ij1NAAI', 's6PIJpw6B88fTvQkEDr', 'DOa6D6wqfDmqpO5Gh08', 'hFRVq7wXKQG031SyYX5', 'wQgrckwfFLw3WZ1uwCh', 'wvVcUAwm7lVIB62iR2a'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, qMNlr7xOiu102s6Kub.cs	High entropy of concatenated method names: 'Field1', 'CePe5a3BF', 'Field2', 'Field3', 'e02PBbjL3', 'fY8RRRypK', 'jZPyB5nGB', 'DBnZHdlE98h2Mipj0qJ', 'YsS9jZl8cK645wB2LsJ', 'cnYOa0lVlYqwk6Ay8nq'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, sRdhkaHVfRZvwMXFLXj.cs	High entropy of concatenated method names: 'eBihFcTG1B', 'S9fgDp9HUEC8yBow2E0', 'ppaNEP9XZIHMcXVlv0v', 'HLgBQj9fh9qdedanDa7', 'FLbhdruviE', 'N5yhCBkiJ9', 'yQPhwW5K00', 'o8mh2rUcBe', 'vFB0vH9rYSiK024lKgO', 'gckLAi9S86bmEPmvc8k'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, bYCbSc01eTuvRcAM3VG.cs	High entropy of concatenated method names: 'cvoAvslYP2', 'ADRE15ktrZqTrvCrUHd', 'lCsRAwk8HAe8EKkGIoZ', 'opo0MiOINU', 'zH60GTR4JY', 'r4Q0wqgcU0CebOvxxsX', 'UI9bsOgAPv6yL5FZO9F', 'C9OXVZghAg33SaXBFig'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, f6ZghHUDBXH2tYmbacT.cs	High entropy of concatenated method names: 'inlnSs5o2E', 'ITPnpCntwG', 'SPinmyoBYJ', 'VKnnBkR2Ev', 'XUEnDLjCNi', 'kppncMZvGA', 'hhbnAHm1XX', 'j8gnhuTAPg', 'eTuUAqgkg4', 'kq8n4vkfpL'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, C56DgqqHHPFZ3wjEp9K.cs	High entropy of concatenated method names: 'RwmqfVsYjb', 'YRpqrM6bO2', 'dt4qSHpYWO', 'Qw1qpMtuB7', 'LXXqBLRwVC', 'oEHqDhnw3g', 'Msmqcx9tRn', 'SQVqAVyR49', 'Nd0qh1npyC', 'LAlq4o51Sx'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, rukH9XSdr6847h0UoRO.cs	High entropy of concatenated method names: 'kwZSwIFouV', 'rOlS22NOjF', 'CVkSk7ZYLY', 'YnoS9lDe8j', 'hm7S8SFMwd', 'm6VSEUxt7r', 'j7ySvCbJny', 'ToString', 'xR3nQVWpiSONisnYS9I', 'xoGMiiWBYOpihJvvA2r'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, U3g2Fn0EMjdn1l2OYvs.cs	High entropy of concatenated method names: 'UuU0jDnJ9p', 'Eqr0NWRU3h', 'eyY052nXxo', 'iBi53ngrYwj6CBfJ2Gs', 'NnhUEFgf8vvSHwsF98v', 'gOWgAGgmTs3CM8QWTlu', 'GmDmRDgSbCqKpcglVEo', 'Endlltgp4TLDXxui6mq', 'PWLAKagBmMnDnAHYqN8'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, X92ilY6hK042XbCPDTJ.cs	High entropy of concatenated method names: 'fN96Lh5Ox5', 'N7W6n7rkw2', 'D5d7yIdYwGVL8tjfENp', 'dU2ukIdKWFyyViKIQi9', 'mQOmt2dz5i8WoquQYBQ', 'lsDFXsCJwLAMHNM5PPc', 'VExMMpCOjJujvRPkYRg', 'EeIe5vdbmvTVtbsXnI5', 'ddcpYsd7xPXvp3scuYu', 'Ye3MOSC09lD59ZMFlq8'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, ymPuo7hNqu7rH1NPowv.cs	High entropy of concatenated method names: 'pnFoJytIaQQM80HZRJF', 'Cl74jxtMDXLqLkPr77R', 'ceZLn1T8aH', 'uH21uRtYsLSpa2r1swI', 'a5OGRGtKMsbVJLIZQj4', 'qOkHXitzKZgOdiaKTpE', 'eqZY6O8JBhHIqwXiNVH', 'fqA6tl8OebDEe0jERat', 'bn9bBP800j6jcT3F1xa', 'PVEDbE8sG80Uja4IWdT'
Source: 2.2.RegAsm.exe.436060.0.raw.unpack, JXkW8tsDkYjKfFXHfYT.cs	High entropy of concatenated method names: 'aMasAS4Zf3', 'J5oshtQCCC', 'XKPs4kGo99', 'fFSsLZdN04', 'FCFsnrI8NZ', 'mB4sTcQIok', 'QuIsZvvrPX', 'u9oso7lnLU', 'HXYsxm61Qs', 'W8wsQZVH95'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Roaming\DMINktnUtY.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Roaming\J48w21dBmF.exe			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

High number of junk calls founds (likely related to sandbox DOS / API hammering)

Source: Global behavior

Junk call stats: NtWriteFile 1254914

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DMINktnUtY.exe, 00000003.00000002.1702039637.00000000033A0000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\^Q
Source: DMINktnUtY.exe, 00000003.00000002.1702039637.00000000033A0000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE`,^Q
Source: DMINktnUtY.exe, 00000003.00000002.1702039637.00000000033A0000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE

Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Memory allocated: 13C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Memory allocated: 3270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Memory allocated: 2B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe TID: 7536	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe TID: 7552	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ACACA1 FindFirstFileExW,

0_2_00ACACA1

Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: DMINktnUtY.exe, 00000003.00000002.1702039637.00000000033A0000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe`,^q
Source: DMINktnUtY.exe, 00000003.00000002.1702039637.00000000033A0000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: DMINktnUtY.exe, 00000003.00000002.1702039637.00000000033A0000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\^q

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AB87A2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00AB87A2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC203F mov ecx, dword ptr fs:[00000030h]	0_2_00AC203F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC6B75 mov eax, dword ptr fs:[00000030h]	0_2_00AC6B75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041913C mov eax, dword ptr fs:[00000030h]	2_2_0041913C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00411496 mov ecx, dword ptr fs:[00000030h]	2_2_00411496

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ACBE89 GetProcessHeap,

0_2_00ACBE89

Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB88FE SetUnhandledExceptionFilter,	0_2_00AB88FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB89B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00AB89B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB87A2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AB87A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABC783 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00ABC783
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407AF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00407AF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407C53 SetUnhandledExceptionFilter,	2_2_00407C53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407D65 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00407D65
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DD68 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0040DD68

Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe

Memory allocated: page read and write | page guard

Allocates memory in foreign processes

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0106018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0106018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 434000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 436000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 534000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 110B008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\DMINktnUtY.exe "C:\Users\user\AppData\Roaming\DMINktnUtY.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\J48w21dBmF.exe "C:\Users\user\AppData\Roaming\J48w21dBmF.exe"	Jump to behavior

Source: DMINktnUtY.exe, 00000003.00000002.1702039637.00000000034C4000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002DDA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: DMINktnUtY.exe, 00000003.00000002.1702039637.00000000034C4000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002DDA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AB8565 cpuid

0_2_00AB8565

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00AC5185
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00ACE107
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00ACDAA1
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00ACE230
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00ACE336
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00ACDC9C
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00ACE405
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00ACDD8E
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00ACDD43
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00AC56AB
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00ACDEB4
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00ACDE29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_0041E815
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_00414128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_0041EA68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_0041EB91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_0041E402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_0041EC97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_0041ED66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_0041E5FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_0041464E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_0041E6EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_0041E6A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_0041E78A

Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Users\user\AppData\Roaming\DMINktnUtY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Users\user\AppData\Roaming\J48w21dBmF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AB8BB2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00AB8BB2

Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected PureLog Stealer

Stealing of Sensitive Information

Source: Yara match	File source: 2.2.RegAsm.exe.436060.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.4b3c60.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DMINktnUtY.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.J48w21dBmF.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.436060.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1681361554.0000000000742000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1680428465.0000000000CC2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1681601241.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: Process Memory Space: DMINktnUtY.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: J48w21dBmF.exe PID: 7452, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 2.2.RegAsm.exe.436060.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.4b3c60.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DMINktnUtY.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.J48w21dBmF.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.436060.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1681601241.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, type: DROPPED

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 2.2.RegAsm.exe.436060.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.4b3c60.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DMINktnUtY.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.J48w21dBmF.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.436060.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1681361554.0000000000742000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1680428465.0000000000CC2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1681601241.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: Process Memory Space: DMINktnUtY.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: J48w21dBmF.exe PID: 7452, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 2.2.RegAsm.exe.436060.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.4b3c60.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DMINktnUtY.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.J48w21dBmF.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.4b3c60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.436060.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1681601241.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1317026
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\DMINktnUtY.exe	100%	Avira	HEUR/AGEN.1323361
C:\Users\user\AppData\Roaming\J48w21dBmF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\DMINktnUtY.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe
https://api.ip.s	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
56.126.166.20.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.s	DMINktnUtY.exe, 00000003.00000002.1702039637.0000000003271000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/users/	J48w21dBmF.exe, 00000004.00000002.1701185664.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	DMINktnUtY.exe, 00000003.00000002.1708371377.0000000007222000.00000004.00000800.00020000.00000000.sdmp, J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	J48w21dBmF.exe, 00000004.00000002.1709171602.0000000006F32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482542
Start date and time:	2024-07-26 01:01:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@10/4@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 58 Number of non-executed functions: 77
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\J48w21dBmF.exe	file.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, Quasar, RedLine	Browse
	R4Hv8s2UzU.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DMINktnUtY.exe.log

Process:	C:\Users\user\AppData\Roaming\DMINktnUtY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\J48w21dBmF.exe.log

Process:	C:\Users\user\AppData\Roaming\J48w21dBmF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Roaming\DMINktnUtY.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	522752
Entropy (8bit):	5.951577023655318
Encrypted:	false
SSDEEP:	6144:M7usalgH+8mMCcbOk3xJua0pKzTqpD0HN5O1oLKZSIV:M7usal++9kBq0OpGS2LuSIV
MD5:	74E358F24A40F37C8FFD7FA40D98683A
SHA1:	7A330075E6EA3D871EAEEFCECDEB1D2FEB2FC202
SHA-256:	0928C96B35CD4CC5887FB205731AA91EB68886B816BCC5EC151AEEE81CE4F9A6
SHA-512:	1525E07712C35111B56664E1589B1DB37965995CC8E6D9B6F931FA38B0AA8E8347FC08B870D03573D10F0D597A2CD9DB2598845C82B6C085F0DF04F2A3B46EAF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0......v........... ........@.. .......................`............@.....................................K.......pr...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...pr.......t..................@..@.reloc.......@......................@..B........................H.......D...........f....(...)..............................................(....(.....0...........s........~....%:....&~......"...s....%.....(...+o.....8[....o...............%..F~#...(.....%..G~#...(.....%..H~#...(.....%..e~#...(.....~$...(.......o......8......(......s.......su.......~....}....~...........s....(....o....}......{.....I~#...(....o........9......I~#...(.......8C........~#...(....o....:......{....~%...(....8......{....~&...(.........(...........9........o.....

C:\Users\user\AppData\Roaming\J48w21dBmF.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	515072
Entropy (8bit):	5.8837492625998085
Encrypted:	false
SSDEEP:	6144:/y1uYzDsaZxRqwwyUwNUll+/i+jqybFrdpfuqbY+lid1Dq1DEYu:61uYzDdZxRqw4walQXbF7521e1op
MD5:	2C2BE38FB507206D36DDDB3D03096518
SHA1:	A16EDB81610A080096376D998E5DDC3E4B54BBD6
SHA-256:	0C7173DAAA5AD8DABE7A2CDE6DBD0EEE1CA790071443AA13B01A1E731053491E
SHA-512:	E436954D7D5B77FEB32F200CC48CB01F94B449887443A1E75EBEF2F6FA2139D989D65F5EA7A71F8562C3AAE2FEA4117EFC87E8AAE905E1BA466FBC8BB328B316
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: R4Hv8s2UzU.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....O...............0..F...........d... ........@.. .......................@............@..................................c..K.......d.................... ....................................................... ............... ..H............text...4D... ...F.................. ..`.rsrc...d............H..............@..@.reloc....... ......................@..B.................d......H........Z..8...........$...................................................(....(......(......(.....0...........s........~....%:....&~......$...s....%.....(...+o.....8[....o...............%..F~(...(.....%..G~(...(.....%..H~(...(.....%..e~(...(.....~)...(.......o......8......(......s.......s........~....}....~...........s....(....o....}......{.....I~(...(....o........9......I~(...(.......8C........~(...(....o....:......{....~*...(....8......{....~+...(.........(..........

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.929603549541649
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'464'832 bytes
MD5:	04e90b2cf273efb3f6895cfcef1e59ba
SHA1:	79afcc39db33426ee8b97ad7bfb48f3f2e4c3449
SHA256:	e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e
SHA512:	72aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555
SSDEEP:	24576:HFTGHKQCRBkD/5vn3MdVu9VNY5oofD0f8jKchmlZ38HKlzNCPvk8IjOz4H0czmue:pGHW7E/5/kVQDooorBvmnVovHIakHVmH
TLSH:	3565220571C4C473D677253209E4E2B96ABEF8700BA25B8F67585F7E5F30683C630A6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.X.............t.......t.......t.......t..............n.......n.......n......._......._......._.......Rich...................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x408441
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A25DBA [Thu Jul 25 14:14:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6addd02d82538c2ca23958c8c292883b

Entrypoint Preview

Instruction
call 00007F3FE4CC6B9Eh
jmp 00007F3FE4CC6259h
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F3FE4CC6C8Fh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F3FE4CC6C79h
int3
int3
int3
int3
push ebx
push esi
mov eax, dword ptr [esp+18h]
or eax, eax
jne 00007F3FE4CC63FAh
mov ecx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+0Ch]
div ecx
mov edx, ebx
jmp 00007F3FE4CC6423h
mov ecx, eax
mov ebx, dword ptr [esp+14h]
mov edx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 00007F3FE4CC63D6h
div ebx
mov esi, eax
mul dword ptr [esp+18h]
mov ecx, eax
mov eax, dword ptr [esp+14h]
mul esi
add edx, ecx
jc 00007F3FE4CC63F0h
cmp edx, dword ptr [esp+10h]
jnbe 00007F3FE4CC63EAh
jc 00007F3FE4CC63E9h
cmp eax, dword ptr [esp+0Ch]
jbe 00007F3FE4CC63E3h
dec esi
xor edx, edx
mov eax, esi
pop esi
pop ebx
retn 0010h
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
mov eax, dword ptr [esp+14h]
or eax, eax
jne 00007F3FE4CC63FAh
mov ecx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
xor edx, edx
div ecx
mov eax, dword ptr [esp+08h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x309c0	0xb8	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30a78	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x168000	0x2064	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2df48	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2df80	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2de88	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26000	0x16c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x23147	0x23200	8fb69ceb8576bdf5e51d052017e8d4ae	False	0.5813083852313167	data	6.624309201579866	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.zzZ	0x25000	0x720	0x800	a5a1587b92aec5f21fa2f42d68b726ee	False	0.66845703125	data	6.146447531049635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26000	0xb2f2	0xb400	4e7c5ece6142a0ce583c14cfe96ef121	False	0.422265625	data	4.893998198324542	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x32000	0x1354bc	0x134600	3062aaa0c6480fc87b81dd06f16eeae1	False	0.9957952789319011	data	7.998850387116656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x168000	0x2064	0x2200	17d8a3f3c7e5dfa01b689c1ca66d78fe	False	0.7172564338235294	data	6.402163113953746	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

WaitForSingleObject, CreateThread, VirtualAllocEx, FreeConsole, RaiseException, InitOnceBeginInitialize, InitOnceComplete, CloseHandle, GetCurrentThreadId, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, EncodePointer, DecodePointer, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetStringTypeW, GetCPInfo, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, CreateFileW, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, SetStdHandle, HeapSize, WriteConsoleW

Exports

Name	Ordinal	Address
QuitMessageStr	1	0x42570f
_QuitMessageStr	2	0x42570f
_QuitMessageStr2	3	0x42570f
_QuitMessageStr3	4	0x42570f
_QuitMessageStr4	5	0x42570f

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T01:02:39.138594+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49735	52.165.165.26	192.168.2.4
2024-07-26T01:03:00.592832+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	62408	20.12.23.50	192.168.2.4
2024-07-26T01:02:59.378967+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	62407	20.12.23.50	192.168.2.4

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 01:02:41.086441994 CEST	53	54177	1.1.1.1	192.168.2.4
Jul 26, 2024 01:02:54.647083044 CEST	53	52629	162.159.36.2	192.168.2.4
Jul 26, 2024 01:02:55.165905952 CEST	60705	53	192.168.2.4	1.1.1.1
Jul 26, 2024 01:02:55.174444914 CEST	53	60705	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 01:02:55.165905952 CEST	192.168.2.4	1.1.1.1	0x58d	Standard query (0)	56.126.166.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 01:02:55.174444914 CEST	1.1.1.1	192.168.2.4	0x58d	Name error (3)	56.126.166.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	19:02:18
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xab0000
File size:	1'464'832 bytes
MD5 hash:	04E90B2CF273EFB3F6895CFCEF1E59BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	19:02:18
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	19:02:21
Start date:	25/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe30000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 00000002.00000002.1681601241.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.1681601241.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000002.00000002.1681601241.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	19:02:22
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\DMINktnUtY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\DMINktnUtY.exe"
Imagebase:	0xcc0000
File size:	522'752 bytes
MD5 hash:	74E358F24A40F37C8FFD7FA40D98683A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000000.1680428465.0000000000CC2000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Roaming\DMINktnUtY.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	19:02:22
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\J48w21dBmF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\J48w21dBmF.exe"
Imagebase:	0x740000
File size:	515'072 bytes
MD5 hash:	2C2BE38FB507206D36DDDB3D03096518
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000000.1681361554.0000000000742000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Roaming\J48w21dBmF.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	19:02:22
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	19:02:22
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true