Create Interactive Tour

Analysis Report KX Trainer V2.exe

Overview

General Information

Sample Name:	KX Trainer V2.exe
Analysis ID:	333458
MD5:	9db4648c520d1cd911aed6e624b8c73e
SHA1:	aed00c67e0791f34b3ee9daf908d009fac22379b
SHA256:	14e3f68a51dd79eab19582804123af477203e8551d20c3c18c93dab184987c1e
Most interesting Screenshot:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

.NET source code references suspicious native API functions

Binary contains a suspicious time stamp

Hides threads from debuggers

PE file contains section with special chars

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect virtualization through RDTSC time measurements

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Classification

Startup

System is w10x64

KX Trainer V2.exe (PID: 4808 cmdline: 'C:\Users\user\Desktop\KX Trainer V2.exe' MD5: 9DB4648C520D1CD911AED6E624B8C73E)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS traffic detected: queries for: krixx.xyz

Source: KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	String found in binary or memory: http://cert.int-x3.letsencrypt.org/0#
Source: KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	String found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
Source: KX Trainer V2.exe	String found in binary or memory: http://james.newtonking.com/projects/json
Source: KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.int-x3.letsencrypt.org0/
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: KX Trainer V2.exe, 00000000.00000002.592456278.000001C6BEA41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp, KX Trainer V2.exe, 00000000.00000003.221379650.000001C6D71D1000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: KX Trainer V2.exe, 00000000.00000003.221379650.000001C6D71D1000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: KX Trainer V2.exe, 00000000.00000003.222683440.000001C6D71D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers0.
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: KX Trainer V2.exe, 00000000.00000002.593899785.000001C6D71C0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designerse
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp, KX Trainer V2.exe, 00000000.00000003.216837611.000001C6D71DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: KX Trainer V2.exe, 00000000.00000003.216837611.000001C6D71DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com_$
Source: KX Trainer V2.exe, 00000000.00000003.216982103.000001C6D71C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comoftv=
Source: KX Trainer V2.exe, 00000000.00000003.216837611.000001C6D71DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comvoi
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: KX Trainer V2.exe, 00000000.00000003.217485422.000001C6D71C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.net
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: KX Trainer V2.exe, 00000000.00000003.223263028.000001C6D71F8000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: AgileDotNetRT64.dll.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: KX Trainer V2.exe, 00000000.00000002.592456278.000001C6BEA41000.00000004.00000001.sdmp	String found in binary or memory: https://krixx.xyz/api/kx/
Source: KX Trainer V2.exe, 00000000.00000002.592456278.000001C6BEA41000.00000004.00000001.sdmp	String found in binary or memory: https://krixx.xyz/api/kx/version/paid.json
Source: KX Trainer V2.exe, 00000000.00000002.592456278.000001C6BEA41000.00000004.00000001.sdmp	String found in binary or memory: https://krixx.xyzateCp
Source: KX Trainer V2.exe	String found in binary or memory: https://nas.llc
Source: KX Trainer V2.exe	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: KX Trainer V2.exe	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

System Summary:

PE file contains section with special chars

Show sources

Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:

Source: AgileDotNetRT64.dll.0.dr

Static PE information: Number of sections : 13 > 10

Source: KX Trainer V2.exe, 00000000.00000002.594991504.000001C6D7650000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs KX Trainer V2.exe
Source: KX Trainer V2.exe, 00000000.00000002.592062977.000001C6BE810000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs KX Trainer V2.exe
Source: KX Trainer V2.exe, 00000000.00000002.592135401.000001C6BE870000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameclrjit.dllT vs KX Trainer V2.exe
Source: KX Trainer V2.exe, 00000000.00000003.214446257.000001C6BCE80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs KX Trainer V2.exe
Source: KX Trainer V2.exe, 00000000.00000002.589893686.000001C6BCBEB000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs KX Trainer V2.exe
Source: KX Trainer V2.exe	Binary or memory string: OriginalFilenameGW2_KX_CSHARP.exe< vs KX Trainer V2.exe

Source: AgileDotNetRT64.dll.0.dr	Static PE information: Section: ZLIB complexity 1.00070658894
Source: AgileDotNetRT64.dll.0.dr	Static PE information: Section: ZLIB complexity 1.0060076461
Source: AgileDotNetRT64.dll.0.dr	Static PE information: Section: ZLIB complexity 1.2972972973
Source: AgileDotNetRT64.dll.0.dr	Static PE information: Section: ZLIB complexity 0.99768115942
Source: AgileDotNetRT64.dll.0.dr	Static PE information: Section: ZLIB complexity 1.02244897959
Source: AgileDotNetRT64.dll.0.dr	Static PE information: Section: ZLIB complexity 1.44
Source: AgileDotNetRT64.dll.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: KX Trainer V2.exe, Newtonsoft.Json/Linq/JRaw.cs

Task registration methods: 'CreateAsync'

Source: classification engine

Classification label: mal64.evad.winEXE@1/1@2/1

Source: C:\Users\user\Desktop\KX Trainer V2.exe

File created: C:\Users\user\AppData\Local\Temp\e2dc8871-2a55-499b-ab2d-7a39de684617

Jump to behavior

Source: KX Trainer V2.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\KX Trainer V2.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe

File read: C:\Users\user\Desktop\KX Trainer V2.exe:Zone.Identifier

Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: KX Trainer V2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: KX Trainer V2.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: KX Trainer V2.exe

Static file information: File size 7560192 > 1048576

Source: KX Trainer V2.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x723c00

Source: KX Trainer V2.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:

Binary string: clrjit.pdb source: KX Trainer V2.exe, 00000000.00000002.594031438.000001C6D72C0000.00000004.00000001.sdmp

Data Obfuscation:

Binary contains a suspicious time stamp

Show sources

Source: initial sample

Static PE information: 0xE66D9ADF [Thu Jul 3 16:59:11 2092 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name:
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name: .exports
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name: .imports
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name: .themida
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name: .loadcon
Source: AgileDotNetRT64.dll.0.dr	Static PE information: section name: .boot

Source: initial sample

Static PE information: section name: entropy: 7.97791699565

Source: C:\Users\user\Desktop\KX Trainer V2.exe

File created: C:\Users\user\AppData\Local\Temp\e2dc8871-2a55-499b-ab2d-7a39de684617\AgileDotNetRT64.dll

Jump to dropped file

Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\Desktop\KX Trainer V2.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\KX Trainer V2.exe

RDTSC instruction interceptor: First address: 00007FFB4871202F second address: 00007FFB487120B0 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov dword ptr [esp+28h], eax 0x0000000e dec eax 0x0000000f mov eax, dword ptr [esp+30h] 0x00000013 dec eax 0x00000014 mov ecx, dword ptr [esp+28h] 0x00000018 dec eax 0x00000019 sub ecx, eax 0x0000001b dec eax 0x0000001c mov eax, ecx 0x0000001e dec eax 0x0000001f add esp, 48h 0x00000022 ret 0x00000023 dec eax 0x00000024 mov dword ptr [00011206h], eax 0x0000002a mov dword ptr [esp+28h], 00000000h 0x00000032 jmp 00007F26D83BB51Ch 0x00000034 mov eax, dword ptr [esp+50h] 0x00000038 cmp dword ptr [esp+28h], eax 0x0000003c jnl 00007F26D83BB554h 0x0000003e rdtsc

Source: C:\Users\user\Desktop\KX Trainer V2.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe	Window / User API: threadDelayed 1355	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Window / User API: threadDelayed 361	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Window / User API: threadDelayed 800	Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe TID: 2592	Thread sleep time: -135500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe TID: 5456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe TID: 5456	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe TID: 5456	Thread sleep time: -99844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe TID: 5456	Thread sleep time: -99703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe TID: 5456	Thread sleep time: -99594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe TID: 5456	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe TID: 5456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe

Last function: Thread delayed

Source: KX Trainer V2.exe, 00000000.00000002.596708179.000001C6D8A90000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\KX Trainer V2.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

.NET source code references suspicious native API functions

Show sources

Source: KX Trainer V2.exe, Gma.System.MouseKeyHook/WinApi/KeyboardNativeMethods.cs	Reference to suspicious API methods: ('MapVirtualKeyEx', 'MapVirtualKeyEx@user32.dll')
Source: KX Trainer V2.exe, u003cAgileDotNetRTu003e.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibraryA', 'LoadLibraryA@kernel32.dll')
Source: KX Trainer V2.exe, Memory/Mem.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32.dll'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll'), ('OpenProcess', 'OpenProcess@kernel32.dll'), ('CreateRemoteThread', 'CreateRemoteThread@kernel32')
Source: KX Trainer V2.exe, GW2_KX_CSHARP/MemTools.cs	Reference to suspicious API methods: ('VirtualProtectEx', 'VirtualProtectEx@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')

Source: KX Trainer V2.exe, 00000000.00000002.591916902.000001C6BD2D0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: KX Trainer V2.exe, 00000000.00000002.591916902.000001C6BD2D0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: KX Trainer V2.exe, 00000000.00000002.591916902.000001C6BD2D0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: KX Trainer V2.exe, 00000000.00000002.591916902.000001C6BD2D0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Users\user\Desktop\KX Trainer V2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\KX Trainer V2.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\KX Trainer V2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection1	Virtualization/Sandbox Evasion14	OS Credential Dumping	Security Software Discovery321	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Virtualization/Sandbox Evasion14	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing2	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Timestomp1	Cached Domain Credentials	System Information Discovery112	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
KX Trainer V2.exe	4%	Virustotal		Browse
KX Trainer V2.exe	2%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\e2dc8871-2a55-499b-ab2d-7a39de684617\AgileDotNetRT64.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\e2dc8871-2a55-499b-ab2d-7a39de684617\AgileDotNetRT64.dll	2%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
krixx.xyz	0%	Virustotal		Browse
cdn.onenote.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.sajatypeworks.comvoi	0%	Avira URL Cloud	safe
https://nas.llc	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com_$	0%	Avira URL Cloud	safe
https://krixx.xyz/api/kx/version/paid.json	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.typography.net	0%	URL Reputation	safe
http://www.typography.net	0%	URL Reputation	safe
http://www.typography.net	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://krixx.xyzateCp	0%	Avira URL Cloud	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.int-x3.letsencrypt.org0/	0%	URL Reputation	safe
http://ocsp.int-x3.letsencrypt.org0/	0%	URL Reputation	safe
http://ocsp.int-x3.letsencrypt.org0/	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
https://krixx.xyz/api/kx/	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.sajatypeworks.comoftv=	0%	Avira URL Cloud	safe

Domains and IPs Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
krixx.xyz	194.5.156.24	true	false	0%, Virustotal, Browse	unknown
cdn.onenote.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.comvoi	KX Trainer V2.exe, 00000000.00000003.216837611.000001C6D71DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://nas.llc	KX Trainer V2.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false		high
http://www.sajatypeworks.com_$	KX Trainer V2.exe, 00000000.00000003.216837611.000001C6D71DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://krixx.xyz/api/kx/version/paid.json	KX Trainer V2.exe, 00000000.00000002.592456278.000001C6BEA41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp, KX Trainer V2.exe, 00000000.00000003.221379650.000001C6D71D1000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers0.	KX Trainer V2.exe, 00000000.00000003.222683440.000001C6D71D2000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp, KX Trainer V2.exe, 00000000.00000003.216837611.000001C6D71DB000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	AgileDotNetRT64.dll.0.dr	false		high
http://www.typography.net	KX Trainer V2.exe, 00000000.00000003.217485422.000001C6D71C2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designerse	KX Trainer V2.exe, 00000000.00000002.593899785.000001C6D71C0000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.com	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.de	KX Trainer V2.exe, 00000000.00000003.223263028.000001C6D71F8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	KX Trainer V2.exe, 00000000.00000002.592456278.000001C6BEA41000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.root-x1.letsencrypt.org0	KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false		high
http://cps.letsencrypt.org0	KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://krixx.xyzateCp	KX Trainer V2.exe, 00000000.00000002.592456278.000001C6BEA41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cert.int-x3.letsencrypt.org/0#	KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	false		high
http://ocsp.thawte.com0	AgileDotNetRT64.dll.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.int-x3.letsencrypt.org0/	KX Trainer V2.exe, 00000000.00000002.596754194.000001C6D8AAE000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.symauth.com/cps0(	AgileDotNetRT64.dll.0.dr	false		high
http://james.newtonking.com/projects/json	KX Trainer V2.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false		high
https://krixx.xyz/api/kx/	KX Trainer V2.exe, 00000000.00000002.592456278.000001C6BEA41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	AgileDotNetRT64.dll.0.dr	false		high
http://www.jiyu-kobo.co.jp/	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.newtonsoft.com/jsonschema	KX Trainer V2.exe	false		high
http://www.sajatypeworks.comoftv=	KX Trainer V2.exe, 00000000.00000003.216982103.000001C6D71C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers8	KX Trainer V2.exe, 00000000.00000002.595142621.000001C6D7690000.00000002.00000001.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	KX Trainer V2.exe	false		high
http://www.fontbureau.com/designers/	KX Trainer V2.exe, 00000000.00000003.221379650.000001C6D71D1000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.5.156.24	unknown	Germany		47583	AS-HOSTINGERLT	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	333458
Start date:	22.12.2020
Start time:	21:50:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	KX Trainer V2.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.evad.winEXE@1/1@2/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 4.9% (good quality ratio 4.1%) Quality average: 66% Quality standard deviation: 29.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.42.151.234, 52.147.198.201, 51.104.139.180, 23.210.248.85, 92.122.213.194, 92.122.213.247, 20.54.26.129, 8.253.95.120, 67.27.157.254, 8.248.147.254, 67.27.158.126, 67.27.234.126, 51.103.5.186, 51.11.168.160, 2.17.179.193, 84.53.167.113, 52.155.217.156 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, wns.notify.windows.com.akadns.net, e15275.g.akamaiedge.net, arc.msn.com, cdn.onenote.net.edgekey.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, par02p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, wildcard.weather.microsoft.com.edgekey.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, db3p-ris-pf-prod-atm.trafficmanager.net, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, tile-service.weather.microsoft.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, e1553.dspg.akamaiedge.net, skypedataprdcolwus16.cloudapp.net Execution Graph export aborted for target KX Trainer V2.exe, PID 4808 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:51:11	API Interceptor	5x Sleep call for process: KX Trainer V2.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-HOSTINGERLT	https://j.mp/3h2fG2Z	Get hash	malicious	Browse	156.67.222.153
	JgHsz8Vvc8.exe	Get hash	malicious	Browse	213.190.6.55
	PO.doc	Get hash	malicious	Browse	213.190.6.55
	Proforma Invoice.doc	Get hash	malicious	Browse	213.190.6.55
	hUWiJym6fy.exe	Get hash	malicious	Browse	31.170.161.37
	YT0nfh456s.exe	Get hash	malicious	Browse	2.57.90.16
	KYC - 17DEC.xlsx	Get hash	malicious	Browse	31.220.110.116
	PByYRsoSNX.exe	Get hash	malicious	Browse	2.57.90.16
	BsR85tOyjL.exe	Get hash	malicious	Browse	46.17.175.180
	XrpfRIQLYI.doc	Get hash	malicious	Browse	156.67.222.204
	https://uc7b53be34470077fa5a225e12df.dl.dropboxusercontent.com/cd/0/get/BFOurBML9LTrYESsgZVnt-7s_XcT1zeXR_UKUe727s4pkHr9HASCTbLCGqW4UetiP2mCY9lexFN5bUjD5CxShlCu3wHWVLxNCOSCmgAvE_LtIaQIjaEAJPiqPF2MmSeHZlw/file?dl=1	Get hash	malicious	Browse	156.67.222.204
	Copy_NE585IS.doc	Get hash	malicious	Browse	156.67.222.204
	Copy_NE585IS.doc	Get hash	malicious	Browse	156.67.222.204
	Copy_NE585IS.doc	Get hash	malicious	Browse	156.67.222.204
	F9FX9EoKDL.exe	Get hash	malicious	Browse	31.220.110.116
	NEW ORDER 15DEC.xlsx	Get hash	malicious	Browse	31.220.110.116
	athwIp3L1t.exe	Get hash	malicious	Browse	46.17.175.180
	iUUJykFNh2.doc	Get hash	malicious	Browse	185.210.145.17
	iUUJykFNh2.doc	Get hash	malicious	Browse	185.210.145.17
	iUUJykFNh2.doc	Get hash	malicious	Browse	185.210.145.17

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://dj.4zido.de/i/612BRNn/	Get hash	malicious	Browse	194.5.156.24
	http://gluonpharma.com/fonts/W/	Get hash	malicious	Browse	194.5.156.24
	X38U6JbAKL.exe	Get hash	malicious	Browse	194.5.156.24
	PO-A2031150 AVI41916.exe	Get hash	malicious	Browse	194.5.156.24
	7vOBf2SPwn.exe	Get hash	malicious	Browse	194.5.156.24
	iEchB4J2pv.exe	Get hash	malicious	Browse	194.5.156.24
	https://podcasterz.hu/softaculous/RjcHrladaah1w/	Get hash	malicious	Browse	194.5.156.24
	https://caminhodosveadeiros.com.br/h/Ld51n5yo2sVpA9ix2ZHZLqX7/	Get hash	malicious	Browse	194.5.156.24
	DHL EXPRESS doc.exe	Get hash	malicious	Browse	194.5.156.24
	7TwZx5dbbZ.exe	Get hash	malicious	Browse	194.5.156.24
	5cHIX9Sf17.exe	Get hash	malicious	Browse	194.5.156.24
	2vR3N8BqTU.exe	Get hash	malicious	Browse	194.5.156.24
	pHsmU6KRZV.exe	Get hash	malicious	Browse	194.5.156.24
	PAYO9080089.exe	Get hash	malicious	Browse	194.5.156.24
	suk1MHq6DK.exe	Get hash	malicious	Browse	194.5.156.24
	uQQ6orCz0I.exe	Get hash	malicious	Browse	194.5.156.24
	Payment Slip.pdf.exe	Get hash	malicious	Browse	194.5.156.24
	https://upinsmokebatonrouge.com/var/kZKk4S0XnGUwc0OKsia1/	Get hash	malicious	Browse	194.5.156.24
	46f0577f-630d-4d6e-a63a-8757c967f3f8.exe	Get hash	malicious	Browse	194.5.156.24
	SHIPPING INVOICE.pdf.exe	Get hash	malicious	Browse	194.5.156.24

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\e2dc8871-2a55-499b-ab2d-7a39de684617\AgileDotNetRT64.dll Download File
Process:	C:\Users\user\Desktop\KX Trainer V2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3223976
Entropy (8bit):	7.960889817927068
Encrypted:	false
SSDEEP:	98304:Z9uDqOHJfCBCxvqxT6u8PgLonwxCqwJ4/V0Z:Z94HJaBCx2ePPYbwI6
MD5:	4D8082B3DE02F82DB9A515E9DAB5D2B6
SHA1:	057A20ADE70244601D0FE50F7011C95BAE335EA5
SHA-256:	936B1537B6EFCECE032C05661238B06BEEFC61FF76E82B7C5D9FE558A9360A4C
SHA-512:	7B9153E9948E0F911FCB0B145678A56CAC4ABD948FA99E07C331760F02DCE096CF3BE7D2D8493CF7A76460C7172E24EAA45C1283A28353501B2876C54752C60D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..4..zg..zg..zg.w.g..zgv..g..zg...g..zg..{gM.zgv..g..zg...g..zg...g..zg...g..zg...g..zg...g..zgRich..zg........................PE..d...'..\.........." .........2......X.V...............................................1...@..........................................p..s...................h.U.......1......................................................................"..`................... ........tX.................. ..` ........'....`..............@..@ X....0..%....h..............@... X....@.......j..............@..@ .....P.......r..............@..@ $....`.......t..............@..B.exports.....p.......v..............@..@.imports.............x..............@....rsrc................z..............@..@.themida.`T..........~..............`....loadcon......V......~..............@..@.boot.....0...V...0.................`..`

Static File Info

General
File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.843509762978309
TrID:	Win64 Executable GUI Net Framework (211506/5) 46.89% Win64 Executable GUI (202006/5) 44.79% Win64 Executable (generic) (21505/4) 4.77% Win64 Executable (generic) (12005/4) 2.66% Generic Win/DOS Executable (2004/3) 0.44%
File name:	KX Trainer V2.exe
File size:	7560192
MD5:	9db4648c520d1cd911aed6e624b8c73e
SHA1:	aed00c67e0791f34b3ee9daf908d009fac22379b
SHA256:	14e3f68a51dd79eab19582804123af477203e8551d20c3c18c93dab184987c1e
SHA512:	e714fb811310aaa0d9f32dfc0c31ad64e32225b5152d29edd8b00ccef5bbf3169d1c6dd7e5f89c3299c9a9db40710cdebf489b27a73574b284ad366b72f3575e
SSDEEP:	196608:S49GV8ld98BlON2jnbNswvBXvowJgzl7GSZn7ftm:FX90jVvBXvoww77rc
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....m..........."......<r..Xs......Zr.. ....@...... ........................s...........`................................

File Icon


Icon Hash:	b231f8f0f0f8e871

Static PE Info

General
Entrypoint:	0xb25abe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0xE66D9ADF [Thu Jul 3 16:59:11 2092 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x725a50	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x726000	0x11ae4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x738000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x10	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2010	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x723ad0	0x723c00	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x726000	0x11ae4	0x11c00	False	0.213729643486	data	3.94727051102	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x738000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x726130	0x10828	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0x736958	0x14	data
RT_VERSION	0x73696c	0x388	data
RT_MANIFEST	0x736cf4	0xdee	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2020 Krixx.xyz
Assembly Version	2.0.0.0
InternalName	GW2_KX_CSHARP.exe
FileVersion	2.0.0.0
CompanyName	Krixx.xyz
LegalTrademarks
Comments	Guild Wars 2 Trainer
ProductName	KX Trainer V2
ProductVersion	2.0.0.0
FileDescription	KX Trainer V2
OriginalFilename	GW2_KX_CSHARP.exe

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 47
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2020 21:51:11.698791981 CET	49729	443	192.168.2.3	194.5.156.24
Dec 22, 2020 21:51:11.724833012 CET	443	49729	194.5.156.24	192.168.2.3
Dec 22, 2020 21:51:11.725040913 CET	49729	443	192.168.2.3	194.5.156.24
Dec 22, 2020 21:51:11.758815050 CET	49729	443	192.168.2.3	194.5.156.24
Dec 22, 2020 21:51:11.782689095 CET	443	49729	194.5.156.24	192.168.2.3
Dec 22, 2020 21:51:11.789231062 CET	443	49729	194.5.156.24	192.168.2.3
Dec 22, 2020 21:51:11.789287090 CET	443	49729	194.5.156.24	192.168.2.3
Dec 22, 2020 21:51:11.789319038 CET	443	49729	194.5.156.24	192.168.2.3
Dec 22, 2020 21:51:11.789458036 CET	49729	443	192.168.2.3	194.5.156.24
Dec 22, 2020 21:51:11.798038960 CET	49729	443	192.168.2.3	194.5.156.24
Dec 22, 2020 21:51:11.822081089 CET	443	49729	194.5.156.24	192.168.2.3
Dec 22, 2020 21:51:11.865906954 CET	49729	443	192.168.2.3	194.5.156.24
Dec 22, 2020 21:51:11.890585899 CET	443	49729	194.5.156.24	192.168.2.3
Dec 22, 2020 21:51:11.932780981 CET	49729	443	192.168.2.3	194.5.156.24
Dec 22, 2020 21:51:17.713191986 CET	443	49729	194.5.156.24	192.168.2.3
Dec 22, 2020 21:51:17.713237047 CET	443	49729	194.5.156.24	192.168.2.3
Dec 22, 2020 21:51:17.713512897 CET	49729	443	192.168.2.3	194.5.156.24
Dec 22, 2020 21:52:51.960719109 CET	49729	443	192.168.2.3	194.5.156.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2020 21:50:55.592377901 CET	58361	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:50:55.616774082 CET	53	58361	8.8.8.8	192.168.2.3
Dec 22, 2020 21:50:59.990118980 CET	63492	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:00.025829077 CET	53	63492	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:02.295015097 CET	60831	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:02.322139025 CET	53	60831	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:03.575201035 CET	60100	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:03.610560894 CET	53	60100	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:04.247205019 CET	53195	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:04.271696091 CET	53	53195	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:05.434782982 CET	50141	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:05.470501900 CET	53	50141	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:06.589452028 CET	53023	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:06.613830090 CET	53	53023	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:07.589210033 CET	49563	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:07.622077942 CET	53	49563	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:08.249258041 CET	51352	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:08.273627996 CET	53	51352	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:08.907733917 CET	59349	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:08.932039022 CET	53	59349	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:09.549938917 CET	57084	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:09.584764004 CET	53	57084	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:10.287733078 CET	58823	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:10.312114954 CET	53	58823	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:11.121953964 CET	57568	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:11.146351099 CET	53	57568	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:11.608711004 CET	50540	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:11.664942026 CET	53	50540	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:12.123415947 CET	54366	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:12.148087978 CET	53	54366	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:23.585604906 CET	53034	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:23.609998941 CET	53	53034	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:27.780776024 CET	57762	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:27.827308893 CET	53	57762	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:28.940970898 CET	55435	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:28.977741957 CET	53	55435	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:41.858010054 CET	50713	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:41.885195971 CET	53	50713	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:45.598160028 CET	56132	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:45.625443935 CET	53	56132	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:46.887651920 CET	58987	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:46.938136101 CET	53	58987	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:48.315212011 CET	56579	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:48.340008020 CET	53	56579	8.8.8.8	192.168.2.3
Dec 22, 2020 21:51:51.477916956 CET	60633	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:51:51.512207985 CET	53	60633	8.8.8.8	192.168.2.3
Dec 22, 2020 21:52:24.284394979 CET	61292	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:52:24.308845997 CET	53	61292	8.8.8.8	192.168.2.3
Dec 22, 2020 21:52:24.612776995 CET	63619	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:52:24.653426886 CET	53	63619	8.8.8.8	192.168.2.3
Dec 22, 2020 21:52:49.938246965 CET	64938	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:52:49.962661982 CET	53	64938	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:22.543087006 CET	61946	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:22.543432951 CET	64910	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:22.577122927 CET	53	64910	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:22.582959890 CET	53	61946	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:43.027098894 CET	52123	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:43.143749952 CET	53	52123	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:43.712729931 CET	56130	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:43.748471022 CET	53	56130	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:44.403774977 CET	56338	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:44.437979937 CET	53	56338	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:44.786068916 CET	59420	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:44.818578959 CET	53	59420	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:47.705167055 CET	58784	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:47.738282919 CET	53	58784	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:48.115478992 CET	63978	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:48.148287058 CET	53	63978	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:48.741339922 CET	62938	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:48.779218912 CET	53	62938	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:49.501714945 CET	55708	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:49.534647942 CET	53	55708	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:50.387211084 CET	56803	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:50.422147989 CET	53	56803	8.8.8.8	192.168.2.3
Dec 22, 2020 21:53:50.977252007 CET	57145	53	192.168.2.3	8.8.8.8
Dec 22, 2020 21:53:51.009991884 CET	53	57145	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 22, 2020 21:51:11.608711004 CET	192.168.2.3	8.8.8.8	0x5e3d	Standard query (0)	krixx.xyz	A (IP address)	IN (0x0001)
Dec 22, 2020 21:53:22.543432951 CET	192.168.2.3	8.8.8.8	0xc7be	Standard query (0)	cdn.onenote.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 22, 2020 21:51:11.664942026 CET	8.8.8.8	192.168.2.3	0x5e3d	No error (0)	krixx.xyz		194.5.156.24	A (IP address)	IN (0x0001)
Dec 22, 2020 21:53:22.577122927 CET	8.8.8.8	192.168.2.3	0xc7be	No error (0)	cdn.onenote.net	cdn.onenote.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Dec 22, 2020 21:51:11.789319038 CET	194.5.156.24	443	192.168.2.3	49729	CN=krixx.xyz CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Nov 04 19:38:23 CET 2020 Thu Mar 17 17:40:46 CET 2016	Tue Feb 02 19:38:23 CET 2021 Wed Mar 17 17:40:46 CET 2021	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	3b5074b1b5d032e5620f69f9f700ff0e
Dec 22, 2020 21:51:11.789319038 CET	194.5.156.24	443	192.168.2.3	49729	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021		3b5074b1b5d032e5620f69f9f700ff0e

Code Manipulations

Statistics

CPU Usage

• KX Trainer V2.exe

Click to jump to process

Memory Usage

• KX Trainer V2.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

System Behavior

Analysis Process: KX Trainer V2.exe PID: 4808 Parent PID: 5508

Function Logs

General

Start time:	21:51:02
Start date:	22/12/2020
Path:	C:\Users\user\Desktop\KX Trainer V2.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\KX Trainer V2.exe'
Imagebase:	0x1c6bc420000
File size:	7560192 bytes
MD5 hash:	9DB4648C520D1CD911AED6E624B8C73E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

Process Queried

Process Information Set

Show Windows behavior

System Activities

Language or Locale ID Queried

System Information Queried

Show Windows behavior

Timing Activities

Show Windows behavior

Network Activities

Socket bound

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

Object Security Activities

Show Windows behavior

LPC Port Activities

Chronological Activities

Disassembly

Code Analysis

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report KX Trainer V2.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: KX Trainer V2.exe PID: 4808 Parent PID: 5508

General

File Activities