Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	828932
MD5:	d442830fc92de9465d9bf425922173a5
SHA1:	27eaed777470e6a9f855894b2af3c7baa1c812eb
SHA256:	5892a93d287a1e4bd97fb09b79b6e2af5643103511f3678c8212ec803ff3b449
Tags:	exe
Infos:

Detection

Aurora

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara Aurora Stealer

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Machine Learning detection for sample

Injects a PE file into a foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

file.exe (PID: 2284 cmdline: C:\Users\user\Desktop\file.exe MD5: D442830FC92DE9465D9BF425922173A5)

file.exe (PID: 4980 cmdline: C:\Users\user\Desktop\file.exe MD5: D442830FC92DE9465D9BF425922173A5)

file.exe (PID: 1092 cmdline: C:\Users\user\Desktop\file.exe MD5: D442830FC92DE9465D9BF425922173A5)

file.exe (PID: 1380 cmdline: C:\Users\user\Desktop\file.exe MD5: D442830FC92DE9465D9BF425922173A5)

WMIC.exe (PID: 5476 cmdline: wmic os get Caption MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 1280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3308 cmdline: cmd /C "wmic path win32_VideoController get name" MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 4072 cmdline: wmic path win32_VideoController get name MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

cmd.exe (PID: 4140 cmdline: cmd /C "wmic cpu get name" MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 2324 cmdline: wmic cpu get name MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Aurora	Ransomware	Oktropys	https://twitter.com/malwrhunterteam/status/1001461507513880576 https://www.bleepingcomputer.com/news/security/azorult-trojan-serving-aurora-ransomware-by-malactor-oktropys/ https://www.bleepingcomputer.com/ransomware/decryptor/how-to-decrypt-the-aurora-ransomware-with-auroradecrypter/	https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora

Malware Configuration

Threatname: Aurora

{"C2 url": "138.201.198.8:8081"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.483930551.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security
00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security
Process Memory Space: file.exe PID: 2284	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security
Process Memory Space: file.exe PID: 1380	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
3.2.file.exe.400000.0.unpack	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security
3.2.file.exe.400000.0.raw.unpack	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security
0.2.file.exe.3f29930.1.unpack	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security
0.2.file.exe.3f29930.1.raw.unpack	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security

Snort Signatures

ET TROJAN Win32/Aurora Stealer Thanks Command - Source IP: 138.201.198.8 - Destination IP: 192.168.2.5

Timestamp:	138.201.198.8192.168.2.58081496952043200 03/17/23-17:30:41.217735
SID:	2043200
Source Port:	8081
Destination Port:	49695
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Aurora Stealer Accept Command - Source IP: 138.201.198.8 - Destination IP: 192.168.2.5

Timestamp:	138.201.198.8192.168.2.58081496952043199 03/17/23-17:30:40.120429
SID:	2043199
Source Port:	8081
Destination Port:	49695
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Aurora Stealer WORK Command - Source IP: 138.201.198.8 - Destination IP: 192.168.2.5

Timestamp:	138.201.198.8192.168.2.58081496952043198 03/17/23-17:30:09.566708
SID:	2043198
Source Port:	8081
Destination Port:	49695
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 30%
Source: file.exe	Virustotal: Detection: 26%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: 138.201.198.8:8081

Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 0.0.file.exe.760000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.2.file.exe.3f29930.1.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Aurora {"C2 url": "138.201.198.8:8081"}

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: ClassLibrary2.pdb source: file.exe, 00000000.00000002.420469142.0000000002F21000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2043198 ET TROJAN Win32/Aurora Stealer WORK Command 138.201.198.8:8081 -> 192.168.2.5:49695
Source: Traffic	Snort IDS: 2043199 ET TROJAN Win32/Aurora Stealer Accept Command 138.201.198.8:8081 -> 192.168.2.5:49695
Source: Traffic	Snort IDS: 2043200 ET TROJAN Win32/Aurora Stealer Thanks Command 138.201.198.8:8081 -> 192.168.2.5:49695

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 138.201.198.8:8081

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

IP Address: 138.201.198.8 138.201.198.8

Source: global traffic

TCP traffic: 192.168.2.5:49695 -> 138.201.198.8:8081

Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.198.8

Source: file.exe, 00000000.00000003.335401632.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334573096.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: file.exe, 00000000.00000003.334829707.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w8
Source: file.exe, 00000000.00000003.335401632.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.335453965.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: file.exe, 00000000.00000002.420469142.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: file.exe, 00000000.00000003.356763762.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: file.exe, 00000000.00000003.352433854.000000000A4E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352321678.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352202056.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: file.exe, 00000000.00000003.352202056.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlM
Source: file.exe, 00000000.00000003.352106495.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlN
Source: file.exe, 00000000.00000003.348519834.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: file.exe, 00000000.00000003.348937325.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com.
Source: file.exe, 00000000.00000003.346982913.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.343638348.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348709440.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348519834.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comN
Source: file.exe, 00000000.00000003.349229151.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348937325.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349085304.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comU
Source: file.exe, 00000000.00000003.348937325.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.346982913.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348846391.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348709440.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348519834.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.come
Source: file.exe, 00000000.00000003.346982913.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.343638348.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348519834.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: file.exe, 00000000.00000003.346982913.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comvad
Source: file.exe, 00000000.00000003.358424688.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: file.exe, 00000000.00000003.361055599.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: file.exe, 00000000.00000003.361055599.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers%
Source: file.exe, 00000000.00000003.355609403.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.355944492.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.355809605.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/N
Source: file.exe, 00000000.00000003.359703889.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: file.exe, 00000000.00000003.359703889.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmle
Source: file.exe, 00000000.00000003.358650609.000000000A4ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlN
Source: file.exe, 00000000.00000003.359132661.000000000A4E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358650609.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358838510.000000000A4E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359060111.000000000A4E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlf
Source: file.exe, 00000000.00000003.356763762.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers:
Source: file.exe, 00000000.00000003.356763762.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersV
Source: file.exe, 00000000.00000003.375775911.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersl
Source: file.exe, 00000000.00000003.363887790.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.363652022.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358838510.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358650609.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360858053.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362252318.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.363183458.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.363357084.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360612532.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360357589.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.363484404.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.364086987.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362877883.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360858053.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comTTF
Source: file.exe, 00000000.00000003.355609403.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.355944492.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.355809605.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comU
Source: file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360858053.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362252318.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360612532.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360357589.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360858053.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362252318.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360612532.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360357589.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362877883.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362252318.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.363183458.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362877883.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalsF
Source: file.exe, 00000000.00000003.358838510.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358650609.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359242686.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359465150.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359132661.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.come.com
Source: file.exe, 00000000.00000003.357284781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.357104255.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.356913548.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.357747426.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.357557215.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: file.exe, 00000000.00000003.376303300.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.376041354.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.375775911.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comic
Source: file.exe, 00000000.00000003.376303300.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.376041354.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.375775911.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: file.exe, 00000000.00000003.356763762.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.357284781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358838510.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358650609.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.357104255.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.356913548.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359132661.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359703889.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comoitu
Source: file.exe, 00000000.00000003.359703889.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comq
Source: file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360858053.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360612532.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360357589.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362877883.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comsief7
Source: file.exe, 00000000.00000003.355609403.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comtoTF
Source: file.exe, 00000000.00000003.376303300.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.376041354.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.375775911.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.375552913.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comueom
Source: file.exe, 00000000.00000003.335065058.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.335116048.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334886028.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334925970.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: file.exe, 00000000.00000003.335065058.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.335116048.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.335249316.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334925970.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com(#L
Source: file.exe, 00000000.00000003.334925970.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comicp
Source: file.exe, 00000000.00000003.334886028.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comy
Source: file.exe, 00000000.00000003.338040406.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: file.exe, 00000000.00000003.338360021.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.340443926.000000000A4EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: file.exe, 00000000.00000003.337279918.000000000A4E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337064048.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337208191.000000000A4E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/)
Source: file.exe, 00000000.00000003.348937325.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.343164747.000000000A4E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.340900815.000000000A4E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.342755137.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.346982913.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.338040406.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.341218771.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348846391.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.338360021.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.340443926.000000000A4EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.343638348.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348709440.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348519834.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnN
Source: file.exe, 00000000.00000003.337794063.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cni-f
Source: file.exe, 00000000.00000003.337794063.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl-g
Source: file.exe, 00000000.00000003.337962891.000000000A4EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337794063.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnt
Source: file.exe, 00000000.00000003.366292013.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: file.exe, 00000000.00000003.366292013.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.366739703.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.366292013.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.366497870.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.367006125.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.366497870.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: file.exe, 00000000.00000003.337591527.000000000A4E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337485839.000000000A4E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337279918.000000000A4E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337064048.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337407744.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337208191.000000000A4E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337545124.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.336953413.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: file.exe, 00000000.00000003.336371363.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.itcfonts.
Source: file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.353556246.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352570967.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349713716.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349501543.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/%
Source: file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/?
Source: file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351968972.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352416154.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352202056.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352321678.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/C
Source: file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/J
Source: file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349713716.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351968972.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349501543.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/N
Source: file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/O
Source: file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/U
Source: file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351968972.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352416154.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352202056.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352321678.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0o
Source: file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351968972.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/J
Source: file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/k
Source: file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/oi
Source: file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351968972.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/q
Source: file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ueL
Source: file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/vaC
Source: file.exe, 00000000.00000003.336531465.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.
Source: file.exe, 00000000.00000003.334456986.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334315119.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334261151.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: file.exe, 00000000.00000003.334407976.000000000A4E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334456986.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comatiD
Source: file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comd
Source: file.exe, 00000000.00000003.334407976.000000000A4E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334456986.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comdec
Source: file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comelp
Source: file.exe, 00000000.00000003.334407976.000000000A4E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334456986.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.coment
Source: file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comuma
Source: file.exe, 00000000.00000003.352106495.000000000A4E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: file.exe, 00000000.00000003.336953413.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: file.exe, 00000000.00000003.336818877.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr;
Source: file.exe, 00000000.00000003.337064048.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.336953413.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.krR
Source: file.exe, 00000000.00000003.336818877.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.336953413.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.krormalY
Source: file.exe, 00000000.00000003.340443926.000000000A4EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349085304.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: file.exe, 00000000.00000003.336283100.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com#
Source: file.exe, 00000000.00000003.335535000.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.net
Source: file.exe, 00000000.00000003.335401632.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.335453965.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netr
Source: file.exe, 00000000.00000003.355239770.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: file.exe, 00000000.00000003.343164747.000000000A4E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: jQZLCtTMtT.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: jQZLCtTMtT.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: jQZLCtTMtT.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: jQZLCtTMtT.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: file.exe, 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: ()<>@,;:\"/[]?=,M3.2.0,M11.1.0476837158203125: cannot parse <invalid Value>ASCII_Hex_DigitAddDllDirectoryC:\Windows.old\CLSIDFromStringCallWindowProcWCreateHardLinkWCreatePopupMenuCreateWindowExWDeviceIoControlDialogBoxParamWDragAcceptFilesDrawThemeTextExDuplicateHandleExcludeClipRectFailed to find Failed to load FindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGdiplusShutdownGetActiveWindowGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetDpiForWindowGetEnhMetaFileWGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWGetThreadLocaleHanifi_RohingyaImpersonateSelfInsertMenuItemWIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredLiqualityWalletLoadLibraryExA

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143A2A8	0_2_0143A2A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143BE0C	0_2_0143BE0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143A150	0_2_0143A150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143EC10	0_2_0143EC10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0143CF50	0_2_0143CF50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04F66614	0_2_04F66614
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04F66618	0_2_04F66618
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_054C9F4B	0_2_054C9F4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_054CC621	0_2_054CC621
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004380C0	3_2_004380C0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004484A0	3_2_004484A0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0044B730	3_2_0044B730
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042D840	3_2_0042D840
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00419A54	3_2_00419A54
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00413E70	3_2_00413E70
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00414EA0	3_2_00414EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00414F69	3_2_00414F69

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004376F0 appears 423 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00439880 appears 459 times

Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00464EC0 SetWaitableTimer,SetWaitableTimer,NtWaitForSingleObject,		3_2_00464EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00464E80 NtWaitForSingleObject,		3_2_00464E80

Source: file.exe, 00000000.00000000.308648810.0000000000C16000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamescanui.exeJ vs file.exe
Source: file.exe, 00000000.00000002.420469142.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClassLibrary2.dll< vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamescanui.exeJ vs file.exe

Source: file.exe	ReversingLabs: Detection: 30%
Source: file.exe	Virustotal: Detection: 26%

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "wmic path win32_VideoController get name"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "wmic cpu get name"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "wmic cpu get name"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name	Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\XVlBzgbaiC

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/9@0/1

Source: EFfRsWxPLD.3.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\file.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5880:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1280:120:WilError_01
Source: C:\Users\user\Desktop\file.exe	Mutant created: \Sessions\1\BaseNamedObjects\????????????
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1420:120:WilError_01

Source: file.exe	String found in binary or memory: {91bc9a05-58a7-4042-adda-4ff3bd023d74}
Source: file.exe	String found in binary or memory: .cctor.ctorEventArgsCreateMemberRefsDelegatestypeIDCreateGetStringDelegateownerTypeobjectmethodiBeginInvokeIAsyncResultAsyncCallbackcallbackEndInvokeresultResolveEventArgsAppDomainBitmapMoveFileExkernel32DefaultIsWebApplicationOnCreateMainFormCompilationRelaxationsAttributeRuntimeCompatibilityAttributeDebuggableAttributeSystem.DiagnosticsDebuggingModesAssemblyTitleAttributeAssemblyDescriptionAttributeAssemblyCompanyAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyTrademarkAttributeComVisibleAttributeSystem.Runtime.InteropServicesGuidAttributeAssemblyFileVersionAttributeNeutralResourcesLanguageAttributeTargetFrameworkAttributeSystem.Runtime.VersioningSuppressIldasmAttributeGeneratedCodeAttributeSystem.CodeDom.CompilerEditorBrowsableAttributeEditorBrowsableStateDebuggerNonUserCodeAttributeCompilerGeneratedAttributeAttributeUsageAttributeAttributeTargetsThreadStaticAttributeSTAThreadAttribute{dd653afa-5511-476b-a66e-b09f77e47dda}{91bc9a05-58a7-4042-adda-4ff3bd023d74}AuthenticationModeset_IsSingleInstanceset_EnableVisualStylesset_SaveMySettingsOnExitset_ShutdownStyleShutdownModeget_IsDisposedUtilsGetResourceStringInvalidOperationExceptionActivatorTargetInvocationExceptionget_InnerExceptionget_MessageRemoveContainsKeyEventHandleradd_LoadOperatorsAddObjectConversionsByteToLowerProcessGetCurrentProcessget_MainModuleProcessModuleget_ModuleNameStringBuilderAppendop_InequalityEmptyCharSplitTrimStartsWithSubstringResolveTypeHandleGetFieldsFieldInfoBindingFlagsget_CharsResolveMethodHandleRuntimeMethodHandleGetMethodFromHandleget_IsStaticget_FieldTypeDelegateCreateDelegateGetParametersParameterInfoget_ParameterTypeget_ReturnTypeDynamicMethodSystem.Reflection.EmitGetILGeneratorILGeneratorOpCodesLdarg_0OpCodeEmitLdarg_1Ldarg_2Ldarg_3Ldarg_STailcallCallCallvirtRetSetValueGetModulesModuleget_ModuleHandleInitializeArrayRuntimeFieldHandleInt32get_ModuleGetMethodsLdc_I4get_MetadataTokenSubResolveEventHandlerget_CurrentDomainadd_ResourceResolveGetManifestResourceNamesStackFrameGetMethodStackTraceGetFramesInt16add_AssemblyResolveToBase64StringIndexOfget_ItemPathGetTempPathFormatDirectoryCreateDirectoryDirectoryInfoConcatFileExistsOpenWriteFileStreamWriteLoadFileset_ItemFileLoadExceptionBadImageFormatExceptionTryGetValueCreateEncryptorDESCryptoServiceProviderRijndaelManagedReadByteMD5CryptoServiceProviderFormatExceptionget_PositionGetCallingAssemblyArgumentOutOfRangeExceptionMathMin
Source: file.exe	String found in binary or memory: 75M{91bc9a05-58a7-4042-adda-4ff3bd023d74}

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 5018112 > 1048576

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x471800

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: ClassLibrary2.pdb source: file.exe, 00000000.00000002.420469142.0000000002F21000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04F61454 push ecx; ret	0_2_04F61455
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_054C7541 push 60054898h; ret	0_2_054C754D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_054CD4ED push ss; ret	0_2_054CD4F3
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042F17E pushfd ; ret	3_2_0042F17F
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042F35B pushfd ; ret	3_2_0042F35C
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0041853A pushfd ; ret	3_2_0041853B
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004357E4 pushfd ; retn 006Bh	3_2_004357E5
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0041FEA4 pushfd ; ret	3_2_0041FEA5

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 4416

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_004640F0 rdtsc

3_2_004640F0

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00433690 GetProcessAffinityMask,GetSystemInfo,

3_2_00433690

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_004640F0 rdtsc

3_2_004640F0

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_0044A4E0 RtlAddVectoredExceptionHandler,SetUnhandledExceptionFilter,

3_2_0044A4E0

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Users\user\Desktop\file.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "wmic cpu get name"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\XVlBzgbaiC VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MRAjWwhTHctcuAxhxKQFDaFpLSjFbcXo VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EFfRsWxPLD VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\zpfRFEgmot VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\aFetHsbZRjxAwnwekrBEmfdzdcEkXBAk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jQZLCtTMtT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\CoaNatyyiNKAReKJyiXJrscctNswYNsG VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\History VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RussVmaozF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ZBsbOJiFQG VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ZsnwTKSmVo VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\History VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\History VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temporary Internet Files VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara Aurora Stealer

Source: Yara match	File source: 3.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3f29930.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3f29930.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.483930551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 1380, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: text= zombie#PANIC#% CPU ((PANIC=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625:method:scheme:statusAvestanBengaliBrailleBrowserCaptionChanDirConvertCookiesCopySidCreatedCypriotDeseretElbasanEllipseElymaicEndPageFillRgnFireFoxFreeSidGODEBUGGranthaHEADERSHanunooHistoryIM UsedIO waitIridiumIsChildJanuaryK-MelonKannadaMUI_DltMUI_StdMail.RuMakasarMandaicMarchenMozillaMultaniMyanmarNRGBA64OctoberOrbitumOsmanyaPATHEXTPhantomProfileRadicalSHA-224SHA-256SHA-384SHA-512SetMenuSetRectSharadaShavianSiddhamSinhalaSleepExSogdianSoyomboSputnikSwapperTagalogTibetanTirhutaTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNVivaldiWSARecvWSASendtypes value=abortedcharsetconnectconsolecpuprofexpiresfloat32float64forcegcgctracehead = http://i < capi < leniWalletinvalidlookup minpc= nil keynumber pacer: panic: pdh.dllreaddirrefererrefreshrunningsignal syscalluintptrunknownutf-8''waitingwsarecvwsasend bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AbortDocAcceptExAcceptedArmenianBalineseBopomofoBugineseCancelIoCherokeeChromiumChromodoClassANYCoinbaseConflictContinueCyrillicDecemberDeleteDCDuployanElectrumEndPaintEqualSidEthereumEthiopicExtenderFebruaryFullPathGdiFlushGeorgianGetFocusGetPixelGoStringGujaratiGurmukhiHiraganaIsIconicIsWindowIsZoomedJavaneseK-MeleonKatakanaKayah_LiLinear_ALinear_BMD5+SHA1MahajaniMaxthon3MetamaskMoveToExNO_ERRORNO_PROXYNichromeNovemberOl_ChikiPRIORITYPalettedParseIntPasswordPhags_PaPolylineQIP SurfQuestionReadFileResetDCWSETTINGSSHA3-224SHA3-256SHA3-384SHA3-512SaturdaySetEventSetFocusSetPixelSetTimerStart tgTagbanwaTai_ThamTai_VietTelegramTextOutWThursdayTifinaghTronlinkTypeAAAATypeAXFRUgariticWSAIoctlWaterfoxWeb Data[:word:][signal \Desktopstack=[
Source: file.exe, 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: m=] = ] n=allgallpavx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandatedeaddialermsetagfilefromftpsfunchosthourhttpicmpidleigmpint8itabjaxxjsonkindlinkmap[nonenullopenpathpipepop3profquitreadrootsbrksmtpsse3tRNStcp4tcp6trueudp4uintunixvarywmicxn-- ...
Source: file.exe, 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 0123456789abcdefghijklmnopqrstuvwxyz444089209850062616169452667236328125Go pointer stored into non-Go memoryUnable to determine system directoryaccessing a corrupted shared librarycompressed name in SRV resource dataedwards25519: invalid point encodinghttp: no Location header in responsehttp: unexpected EOF reading trailerjson: encoding error for type %q: %qkey size not a multiple of key alignmethod ABI and value ABI don't alignreflect: NumField of non-struct typeruntime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime: wrong goroutine in newstackryuFtoaFixed64 called with prec > 18strings.Builder.Grow: negative countsyntax error scanning complex numberuncaching span but s.allocCount == 0) is smaller than minimum page size (2220446049250313080847263336181640625UnsubscribeServiceChangeNotifications\AppData\Roaming\Exodus\exodus.wallet_cgo_notify_runtime_init_done missingall goroutines are asleep - deadlock!bytes.Buffer: truncation out of rangecannot create context from nil parentcannot exec a shared library directlycipher: message authentication failedcrypto/rsa: public exponent too largecrypto/rsa: public exponent too smallcrypto: Size of unknown hash functionfailed to reserve page summary memorygzip.Write: non-Latin-1 header stringinternal error: unknown network type logWorkTime: unknown mark worker modemethod ABI and value ABI do not alignreflect.Value.Bytes of non-byte slicereflect.Value.Bytes of non-rune slicereflect.Value.Convert: value of type reflect: Bits of non-arithmetic Type reflect: NumField of non-struct type reflect: funcLayout of non-func type runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptoo many Additionals to pack (>65535)too many Authorities to pack (>65535)value too large for defined data type1110223024625156540423631668090820312555511151231257827021181583404541015625Unable to determine system directory: addtimer called with initialized timerafter decimal point in numeric literalarg size to reflect.call more than 1GBcan not access a needed shared libraryconcurrent map iteration and map writeelem size not a multiple of elem alignencoding alphabet is not 64-bytes longgcBgMarkWorker: blackening not enabledinsufficient data for base length typem changed unexpectedly in cgocallbackgmakechan: invalid channel element typemime: expected slash after first tokenruntime: blocked read on free polldescruntime: sudog with non-false isSelecttime: missing Location in call to Datetls: invalid ClientKeyExchange messagetls: invalid ServerKeyExchange messageunreachable method called. linker bug?zip: unsupported compression algorithm2006-01-
Source: file.exe	String found in binary or memory: _PointSetFileCompletionNotificationModesVirtualQuery for stack base failed\AppData\Roaming\Ethereum\keystorecrypto/rsa: missing public modulusdoaddtimer: P already set in timerforEachP: sched.safePointWait != 0frame_settings_window_size_too_bigframe_windowupda
Source: file.exe, 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: , i = , not , val 390625<-chanAnswerArabicArmoryAugustBitBltBrahmiCANCELCarianChakmaChedotCocCocCommonComodoCookieCoowonCopticCryptoEndDocExodusExpectFolderFormatFridayGOAWAYGOROOTGetACPGoogleGothicGray16GuardaHangulHatranHebrewHyphenKaithiKhojkiKometaLepchaLineToLockedLycianLydianMondayMulDivOxygenPADDEDPragmaRGBA64RejangSCHED STREETSaveDCStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoWombatYandexYezidi[]byte\ufffd^user^acceptactiveatomicchan<-closedcookiedomainefenceexec: expectgopherhangupheaderinternip+netkilledliebaolistenlogs//logs\\minutenumberobjectpopcntrdtscpremovesecondselectsendtoserversocketsocks5stringstructsweep sysmontelnettimersuint16uint32uint64unused (scan (scan) (trap MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil
Source: file.exe, 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: text= zombie#PANIC#% CPU ((PANIC=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625:method:scheme:statusAvestanBengaliBrailleBrowserCaptionChanDirConvertCookiesCopySidCreatedCypriotDeseretElbasanEllipseElymaicEndPageFillRgnFireFoxFreeSidGODEBUGGranthaHEADERSHanunooHistoryIM UsedIO waitIridiumIsChildJanuaryK-MelonKannadaMUI_DltMUI_StdMail.RuMakasarMandaicMarchenMozillaMultaniMyanmarNRGBA64OctoberOrbitumOsmanyaPATHEXTPhantomProfileRadicalSHA-224SHA-256SHA-384SHA-512SetMenuSetRectSharadaShavianSiddhamSinhalaSleepExSogdianSoyomboSputnikSwapperTagalogTibetanTirhutaTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNVivaldiWSARecvWSASendtypes value=abortedcharsetconnectconsolecpuprofexpiresfloat32float64forcegcgctracehead = http://i < capi < leniWalletinvalidlookup minpc= nil keynumber pacer: panic: pdh.dllreaddirrefererrefreshrunningsignal syscalluintptrunknownutf-8''waitingwsarecvwsasend bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AbortDocAcceptExAcceptedArmenianBalineseBopomofoBugineseCancelIoCherokeeChromiumChromodoClassANYCoinbaseConflictContinueCyrillicDecemberDeleteDCDuployanElectrumEndPaintEqualSidEthereumEthiopicExtenderFebruaryFullPathGdiFlushGeorgianGetFocusGetPixelGoStringGujaratiGurmukhiHiraganaIsIconicIsWindowIsZoomedJavaneseK-MeleonKatakanaKayah_LiLinear_ALinear_BMD5+SHA1MahajaniMaxthon3MetamaskMoveToExNO_ERRORNO_PROXYNichromeNovemberOl_ChikiPRIORITYPalettedParseIntPasswordPhags_PaPolylineQIP SurfQuestionReadFileResetDCWSETTINGSSHA3-224SHA3-256SHA3-384SHA3-512SaturdaySetEventSetFocusSetPixelSetTimerStart tgTagbanwaTai_ThamTai_VietTelegramTextOutWThursdayTifinaghTronlinkTypeAAAATypeAXFRUgariticWSAIoctlWaterfoxWeb Data[:word:][signal \Desktopstack=[
Source: file.exe, 00000000.00000002.420469142.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History\Opera Stable\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data\Opera Stable\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies\Opera Stable\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\a776be69-4c6f-4cdc-86d3-b25c3319b53e	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data\Opera Stable\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior

Remote Access Functionality

Yara Aurora Stealer

Source: Yara match	File source: 3.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3f29930.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3f29930.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.483930551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 1380, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	Path Interception	111 Process Injection	1 Masquerading	1 OS Credential Dumping	2 Security Software Discovery	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	11 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	14 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	31%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
file.exe	26%	Virustotal		Browse
file.exe	100%	Avira	TR/Dropper.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.file.exe.760000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
3.2.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.file.exe.3f29930.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.sandoll.co.kr;	0%	Avira URL Cloud	safe
http://www.fontbureau.comTTF	0%	URL Reputation	safe
http://www.fontbureau.comessed	0%	URL Reputation	safe
http://www.fontbureau.comalsF	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnl-g	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.itcfonts.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/%	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.tiro.com#	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/U	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.fontbureau.comic	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/O	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/N	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/J	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/C	0%	URL Reputation	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/?	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.fontbureau.comoitu	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/k	0%	URL Reputation	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
http://www.founder.com.cn/cnN	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/J	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com.	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.typography.net	0%	URL Reputation	safe
http://www.founder.com.cn/cnt	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.htmlM	0%	Avira URL Cloud	safe
http://www.sandoll.co.krR	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/vaC	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.htmlN	0%	Avira URL Cloud	safe
http://www.carterandcone.comvad	0%	Avira URL Cloud	safe
http://www.fontbureau.comsief7	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/ueL	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://en.w8	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comdec	0%	Avira URL Cloud	safe
http://www.carterandcone.comU	0%	URL Reputation	safe
http://www.sajatypeworks.comd	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.carterandcone.comN	0%	URL Reputation	safe
http://www.typography.netr	0%	Avira URL Cloud	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0o	0%	Avira URL Cloud	safe
138.201.198.8:8081	100%	Avira URL Cloud	malware
http://www.fontbureau.comU	0%	URL Reputation	safe
http://www.sandoll.co.krormalY	0%	Avira URL Cloud	safe
http://www.fonts.comicp	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comatiD	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/oi	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.sajatypeworks.coment	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comuma	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comtoTF	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cni-f	0%	URL Reputation	safe
http://www.fontbureau.comq	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.fonts.comy	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.sajatypeworks.comelp	0%	Avira URL Cloud	safe
http://www.fonts.com(#L	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/)	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
138.201.198.8:8081	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.sandoll.co.kr;	file.exe, 00000000.00000003.336818877.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://duckduckgo.com/chrome_newtab	file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	false		high
https://duckduckgo.com/ac/?q=	jQZLCtTMtT.3.dr	false		high
http://www.ascendercorp.com/typedesigners.htmlM	file.exe, 00000000.00000003.352202056.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ascendercorp.com/typedesigners.htmlN	file.exe, 00000000.00000003.352106495.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/vaC	file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comsief7	file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360858053.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360612532.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360357589.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362877883.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	file.exe, 00000000.00000003.361055599.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comTTF	file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360858053.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comessed	file.exe, 00000000.00000003.357284781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.357104255.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.356913548.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.357747426.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.357557215.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comalsF	file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362252318.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.363183458.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362877883.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	file.exe, 00000000.00000003.334456986.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334315119.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334261151.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnl-g	file.exe, 00000000.00000003.337794063.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.krR	file.exe, 00000000.00000003.337064048.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.336953413.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.htmlN	file.exe, 00000000.00000003.358650609.000000000A4ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ascendercorp.com/typedesigners.html	file.exe, 00000000.00000003.352433854.000000000A4E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352321678.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352202056.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.itcfonts.	file.exe, 00000000.00000003.336371363.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/%	file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349713716.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349501543.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/ueL	file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	file.exe, 00000000.00000003.343164747.000000000A4E2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com#	file.exe, 00000000.00000003.336283100.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	file.exe, 00000000.00000002.420469142.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.como.	file.exe, 00000000.00000003.346982913.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.343638348.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348519834.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comvad	file.exe, 00000000.00000003.346982913.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/	file.exe, 00000000.00000003.366292013.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/U	file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.come	file.exe, 00000000.00000003.348937325.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.346982913.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348846391.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348709440.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348519834.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.htmlf	file.exe, 00000000.00000003.359132661.000000000A4E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358650609.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358838510.000000000A4E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359060111.000000000A4E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comic	file.exe, 00000000.00000003.376303300.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.376041354.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.375775911.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/O	file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/N	file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349713716.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351968972.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349501543.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/J	file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	jQZLCtTMtT.3.dr	false		high
http://www.jiyu-kobo.co.jp/C	file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351968972.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352416154.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352202056.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352321678.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.come.com	file.exe, 00000000.00000003.358838510.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358650609.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359242686.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359465150.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359132661.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/?	file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	false		high
http://en.w	file.exe, 00000000.00000003.335401632.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334573096.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	file.exe, 00000000.00000003.338360021.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.340443926.000000000A4EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comoitu	file.exe, 00000000.00000003.356763762.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.357284781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358838510.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358650609.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.357104255.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.356913548.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359132661.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.359703889.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/q	file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351968972.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/k	file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comdec	file.exe, 00000000.00000003.334407976.000000000A4E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334456986.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comals	file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360858053.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362252318.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360612532.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360357589.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362877883.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.w8	file.exe, 00000000.00000003.334829707.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netr	file.exe, 00000000.00000003.335401632.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.335453965.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.krormalY	file.exe, 00000000.00000003.336818877.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.336953413.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnN	file.exe, 00000000.00000003.348937325.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.343164747.000000000A4E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.340900815.000000000A4E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.342755137.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.346982913.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.338040406.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.341218771.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348846391.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.338360021.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.340443926.000000000A4EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.343638348.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348709440.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348519834.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comatiD	file.exe, 00000000.00000003.334407976.000000000A4E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334456986.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/J	file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comicp	file.exe, 00000000.00000003.334925970.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com?fr=crmas_sfpf	file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	false		high
http://www.tiro.com	file.exe, 00000000.00000003.340443926.000000000A4EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349085304.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersV	file.exe, 00000000.00000003.356763762.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/N	file.exe, 00000000.00000003.355609403.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.355944492.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.355809605.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	file.exe, 00000000.00000003.337591527.000000000A4E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337485839.000000000A4E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337279918.000000000A4E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337064048.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337407744.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337208191.000000000A4E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337545124.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.336953413.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	file.exe, 00000000.00000003.348519834.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.coment	file.exe, 00000000.00000003.334407976.000000000A4E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334456986.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.com.	file.exe, 00000000.00000003.348937325.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	file.exe, 00000000.00000003.366292013.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.366739703.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.366292013.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.366497870.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.367006125.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.366497870.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	file.exe, 00000000.00000003.335401632.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.335453965.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersl	file.exe, 00000000.00000003.375775911.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/Y0o	file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351968972.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352416154.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352202056.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352321678.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.net	file.exe, 00000000.00000003.335535000.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnt	file.exe, 00000000.00000003.337962891.000000000A4EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337794063.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	file.exe, 00000000.00000003.335065058.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.335116048.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334886028.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334925970.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	file.exe, 00000000.00000003.336953413.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comU	file.exe, 00000000.00000003.349229151.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348937325.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349085304.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comd	file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.de	file.exe, 00000000.00000003.355239770.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comuma	file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	file.exe, 00000000.00000003.352106495.000000000A4E8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comtoTF	file.exe, 00000000.00000003.355609403.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comy	file.exe, 00000000.00000003.334886028.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comN	file.exe, 00000000.00000003.346982913.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.343638348.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348709440.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.348519834.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	file.exe, 00000000.00000003.358424688.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comF	file.exe, 00000000.00000003.363887790.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.363652022.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358838510.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358650609.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360858053.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362252318.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.363183458.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.363357084.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360612532.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360357589.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.363484404.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.364086987.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362877883.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.agfamonotype.	file.exe, 00000000.00000003.356763762.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	false		high
http://www.fontbureau.comU	file.exe, 00000000.00000003.355609403.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.355944492.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.355809605.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/oi	file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmle	file.exe, 00000000.00000003.359703889.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/	file.exe, 00000000.00000003.351870436.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352106495.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351422934.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351968972.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.350669718.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.coma	file.exe, 00000000.00000003.361390614.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360858053.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362252318.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358246722.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360612532.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.362042227.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.360357589.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361758781.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.361055599.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.358424688.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comelp	file.exe, 00000000.00000003.334493619.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	jQZLCtTMtT.3.dr	false		high
https://search.yahoo.com?fr=crmas_sfp	file.exe, 00000003.00000003.444161760.000000001202B000.00000004.00001000.00020000.00000000.sdmp, jQZLCtTMtT.3.dr	false		high
http://www.founder.com.cn/cn	file.exe, 00000000.00000003.338040406.000000000A4DC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com(#L	file.exe, 00000000.00000003.335065058.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.335116048.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.335249316.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.334925970.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cni-f	file.exe, 00000000.00000003.337794063.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.html	file.exe, 00000000.00000003.359703889.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comq	file.exe, 00000000.00000003.359703889.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.monotype.	file.exe, 00000000.00000003.336531465.000000000A4E4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers%	file.exe, 00000000.00000003.361055599.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	file.exe, 00000000.00000003.351984660.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.353556246.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.352570967.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.349973673.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.como	file.exe, 00000000.00000003.376303300.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.376041354.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.375775911.000000000A4F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/)	file.exe, 00000000.00000003.337279918.000000000A4E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337064048.000000000A4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.337208191.000000000A4E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers:	file.exe, 00000000.00000003.356763762.000000000A4F4000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
138.201.198.8	unknown	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	828932
Start date and time:	2023-03-17 17:28:19 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@20/9@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 89.4% (good quality ratio 48.1%) Quality average: 39.5% Quality standard deviation: 41.9%
HCA Information:	Successful, ratio: 99% Number of executed functions: 32 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:30:09	API Interceptor	3x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
138.201.198.8	file.exe	Get hash	malicious	Aurora, DanaBot, RedLine, SmokeLoader, Stealc	Browse
	aILr0rVvoA.exe	Get hash	malicious	Aurora, DanaBot, SmokeLoader, Stealc	Browse
	o9yHH9sxKX.exe	Get hash	malicious	Aurora, DanaBot, RedLine, SmokeLoader, Stealc	Browse
	file.exe	Get hash	malicious	Aurora, RedLine	Browse
	SCEgQWi3D9.exe	Get hash	malicious	Aurora, RedLine, SmokeLoader, Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.28896.28730.exe	Get hash	malicious	Aurora, RedLine, SmokeLoader	Browse
	KXNnA9XF2X.exe	Get hash	malicious	Aurora	Browse
	r6HCXXcjBo.exe	Get hash	malicious	Aurora, RedLine, SmokeLoader	Browse
	MrlNkx5wSj.exe	Get hash	malicious	Aurora, RedLine, SmokeLoader	Browse
	zwAtMOSGvE.exe	Get hash	malicious	Aurora, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Aurora, RedLine, SmokeLoader	Browse
	tXuIoDrqYw.exe	Get hash	malicious	LimeRAT, RedLine	Browse
	D2MMAYEwZi.exe	Get hash	malicious	RedLine	Browse
	RRYw02YctR.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	116.203.13.130
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	116.203.13.130
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	116.203.13.130
	Form - 16 Mar, 2023.one	Get hash	malicious	Emotet	Browse	95.217.221.146
	ccdc 5b contract explained 17361.js	Get hash	malicious	Unknown	Browse	188.40.17.102
	Vero.html	Get hash	malicious	HtmlDropper	Browse	195.201.55.155
	file.exe	Get hash	malicious	RedLine	Browse	135.181.173.163
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, HTMLPhisher, Vidar	Browse	116.203.13.130
	dot_net_crypted.exe	Get hash	malicious	Vidar	Browse	49.12.239.21
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	116.203.13.130
	file.exe	Get hash	malicious	Aurora, DanaBot, RedLine, SmokeLoader, Stealc	Browse	138.201.198.8
	Voicemail sound attachment.html	Get hash	malicious	HTMLPhisher	Browse	178.63.52.51
	aILr0rVvoA.exe	Get hash	malicious	Aurora, DanaBot, SmokeLoader, Stealc	Browse	138.201.198.8
	o9yHH9sxKX.exe	Get hash	malicious	Aurora, DanaBot, RedLine, SmokeLoader, Stealc	Browse	138.201.198.8
	kwari.x86.elf	Get hash	malicious	Mirai	Browse	144.79.65.18
	D0C93848394-Spodogenic.vbs	Get hash	malicious	Remcos	Browse	94.130.249.123
	MBQ24253060297767042_202303161424.one	Get hash	malicious	Emotet	Browse	95.217.221.146
	iMedPub_LTD_4.one	Get hash	malicious	Emotet	Browse	95.217.221.146
	iMedPub_LTD_6.one	Get hash	malicious	Emotet	Browse	95.217.221.146
	INNOVINC.one	Get hash	malicious	Emotet	Browse	95.217.221.146

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\CoaNatyyiNKAReKJyiXJrscctNswYNsG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	333122
Entropy (8bit):	6.0166085054822025
Encrypted:	false
SSDEEP:	6144:AXNyTOpBmAh4A8Acx6ZaurE5/EDnJpAl9SeefNqWF4iVx/9LPeq/1LHm/dBt:AyT6BmAeVxzurRDn9nfNxF4ijZVtilBt
MD5:	FC9350304206BCAE11EDC5F911EFEA92
SHA1:	0AFC39D86BAF4F1C510D00B5817A677D760FACE2
SHA-256:	7A135CC412FA4152B39EBCAED8817B903DA7968DBAABD6FE657A3A3B5F5D88E1
SHA-512:	A327BD0D57B7D7395A0FC8F742D738FB38C0BB9899A116D5C90061B3998762E9B7660A631A2C25ECAC4968A4DCBB2EF0033BA6A2C2477CF7DD15D0C933C7A3F8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660688430461074e+12,"network":1.660656002e+12,"ticks":401483518.0,"uncertainty":1453614.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIX

C:\Users\user\AppData\Local\Temp\EFfRsWxPLD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MRAjWwhTHctcuAxhxKQFDaFpLSjFbcXo

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	333122
Entropy (8bit):	6.0166085054822025
Encrypted:	false
SSDEEP:	6144:AXNyTOpBmAh4A8Acx6ZaurE5/EDnJpAl9SeefNqWF4iVx/9LPeq/1LHm/dBt:AyT6BmAeVxzurRDn9nfNxF4ijZVtilBt
MD5:	FC9350304206BCAE11EDC5F911EFEA92
SHA1:	0AFC39D86BAF4F1C510D00B5817A677D760FACE2
SHA-256:	7A135CC412FA4152B39EBCAED8817B903DA7968DBAABD6FE657A3A3B5F5D88E1
SHA-512:	A327BD0D57B7D7395A0FC8F742D738FB38C0BB9899A116D5C90061B3998762E9B7660A631A2C25ECAC4968A4DCBB2EF0033BA6A2C2477CF7DD15D0C933C7A3F8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660688430461074e+12,"network":1.660656002e+12,"ticks":401483518.0,"uncertainty":1453614.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIX

C:\Users\user\AppData\Local\Temp\XVlBzgbaiC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 2, database pages 36, 1st free page 10, free pages 4, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.45387870883890413
Encrypted:	false
SSDEEP:	96:iWvdU+bb3DtSOaDN6tOVjN9DLjGQLBE3u:iWvK+H3NGN6IVj3XBBE3u
MD5:	9D9851BF9104273B5AB6337A4E38A4AE
SHA1:	0FF6130A7A10B06B73DAB3687ABA6FCD4E92C2E8
SHA-256:	DBC976D79FBC0F3BA62CDEA6EFDDEEAE0ADD7EBF092B865DBB907A1D9B9DA5E1
SHA-512:	DEF485857FB1F882895122AF5ABBC502E708CA62735FF8AC855DEAEC7334D9858019D7889E90B64258EA08E634F3826B7962C29F331392670521C6EABEA0F5E8
Malicious:	false
Preview:	SQLite format 3......@ .......$...........&......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aFetHsbZRjxAwnwekrBEmfdzdcEkXBAk

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	333122
Entropy (8bit):	6.0166085054822025
Encrypted:	false
SSDEEP:	6144:AXNyTOpBmAh4A8Acx6ZaurE5/EDnJpAl9SeefNqWF4iVx/9LPeq/1LHm/dBt:AyT6BmAeVxzurRDn9nfNxF4ijZVtilBt
MD5:	FC9350304206BCAE11EDC5F911EFEA92
SHA1:	0AFC39D86BAF4F1C510D00B5817A677D760FACE2
SHA-256:	7A135CC412FA4152B39EBCAED8817B903DA7968DBAABD6FE657A3A3B5F5D88E1
SHA-512:	A327BD0D57B7D7395A0FC8F742D738FB38C0BB9899A116D5C90061B3998762E9B7660A631A2C25ECAC4968A4DCBB2EF0033BA6A2C2477CF7DD15D0C933C7A3F8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660688430461074e+12,"network":1.660656002e+12,"ticks":401483518.0,"uncertainty":1453614.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIX

C:\Users\user\AppData\Local\Temp\jQZLCtTMtT

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	333122
Entropy (8bit):	6.0166085054822025
Encrypted:	false
SSDEEP:	6144:AXNyTOpBmAh4A8Acx6ZaurE5/EDnJpAl9SeefNqWF4iVx/9LPeq/1LHm/dBt:AyT6BmAeVxzurRDn9nfNxF4ijZVtilBt
MD5:	FC9350304206BCAE11EDC5F911EFEA92
SHA1:	0AFC39D86BAF4F1C510D00B5817A677D760FACE2
SHA-256:	7A135CC412FA4152B39EBCAED8817B903DA7968DBAABD6FE657A3A3B5F5D88E1
SHA-512:	A327BD0D57B7D7395A0FC8F742D738FB38C0BB9899A116D5C90061B3998762E9B7660A631A2C25ECAC4968A4DCBB2EF0033BA6A2C2477CF7DD15D0C933C7A3F8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660688430461074e+12,"network":1.660656002e+12,"ticks":401483518.0,"uncertainty":1453614.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABUPWY4cSyAQZRX3j8/SLmMAAAAAAIAAAAAABBmAAAAAQAAIAAAACC7lwCjByxIY/Ds1S6cdCxJW6iSr1QfjoKlVKoVEQ4EAAAAAA6AAAAAAgAAIAAAAD9PMfiGkWkdrfU+zeMpOLPS1eDxLpcgjYP2R/ndeCNxMAAAAK+RpovfP61NtB5nOpQgPMjPTyt2T1WPeru9i3yP05zNVEj0uCRDWfONruG9ricX1kAAAADB9KtQ9KY2z38GdfaF7dW2ZLcAMHOX2oEKBg8ZJG9lsuMexxChB4M8HFpyb0Bpr6axpi+zmMIX

C:\Users\user\AppData\Local\Temp\zpfRFEgmot

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 10, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4393511334109407
Encrypted:	false
SSDEEP:	24:TLqlj1czkwubXYFpFNYcw+6UwcYzHrSl:TyxcYwuLopFgU1YzLSl
MD5:	8C31C5487A97BBE73711C5E20600C1F6
SHA1:	D4D6B04226D8FFC894749B3963E7DB7068D6D773
SHA-256:	A1326E74262F4B37628F2E712EC077F499B113181A1E937E752D046E43F1689A
SHA-512:	394391350524B994504F4E748CCD5C3FA8EF980AED850A5A60F09250E8261AC8E300657CBB1DBF305729637BC0E1F043E57799E2A35C82EEA3825CE5C9E7051D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.924268106226824
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	5018112
MD5:	d442830fc92de9465d9bf425922173a5
SHA1:	27eaed777470e6a9f855894b2af3c7baa1c812eb
SHA256:	5892a93d287a1e4bd97fb09b79b6e2af5643103511f3678c8212ec803ff3b449
SHA512:	1ce42ab9055bf0c15f8f4b90820c8d4c74f348dc1e1833d26f55f61b671cdafee24a0777ea60a3a5cf5b297c31380a79a1a7d0568c81886f2472d265f77c7146
SSDEEP:	98304:9j3/I9FTuPXPlGUi317EPTiu0ENWS5ywGDZHU:9/MF4l5GgUEMSrwU
TLSH:	363612BAB9E5FF0AD8778538C560B335D12A9C129253850DD3DB3210BEB27EC2D86D58
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................G..x......b6G.. ...@G...@.. ........................L...........@................................

File Icon


Icon Hash:	71e4b6d46cf8cc13

Static PE Info

General

Entrypoint:	0x873662
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6414B9AA [Fri Mar 17 19:04:10 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x473618	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x474000	0x57460	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4cc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x471668	0x471800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x474000	0x57460	0x57600	False	0.0488309191702432	data	4.284780173398752	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4cc000	0xc	0x200	False	0.044921875	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "G"	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x474094	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	German	Germany
RT_ICON	0x4b60e0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	German	Germany
RT_ICON	0x4c692c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	German	Germany
RT_ICON	0x4c8ef8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	German	Germany
RT_ICON	0x4c9fc4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	German	Germany
RT_ICON	0x4ca970	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	German	Germany
RT_GROUP_ICON	0x4cae28	0x5a	data	German	Germany
RT_VERSION	0x4caebe	0x37c	data
RT_MANIFEST	0x4cb276	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
German	Germany

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
138.201.198.8192.168.2.58081496952043200 03/17/23-17:30:41.217735	TCP	2043200	ET TROJAN Win32/Aurora Stealer Thanks Command	8081	49695	138.201.198.8	192.168.2.5
138.201.198.8192.168.2.58081496952043199 03/17/23-17:30:40.120429	TCP	2043199	ET TROJAN Win32/Aurora Stealer Accept Command	8081	49695	138.201.198.8	192.168.2.5
138.201.198.8192.168.2.58081496952043198 03/17/23-17:30:09.566708	TCP	2043198	ET TROJAN Win32/Aurora Stealer WORK Command	8081	49695	138.201.198.8	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2023 17:30:09.292762041 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:09.315767050 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:09.315901041 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:09.566708088 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:09.615262985 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:20.610646963 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:20.633804083 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:20.638794899 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:20.706290960 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:20.791424036 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:20.814559937 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:20.821824074 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:20.904890060 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:21.655575037 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:21.682756901 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:21.682780981 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:21.682818890 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:21.688469887 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:21.793350935 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:24.850615025 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:24.875174999 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:25.001801968 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.909135103 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.918754101 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.932133913 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.941968918 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.942006111 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.942040920 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.942058086 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.942105055 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.942276001 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.942370892 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.942375898 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.942481041 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.965544939 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.965584993 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.965687037 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.965756893 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.965908051 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.965930939 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.966077089 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.966097116 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.966105938 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.966157913 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.966424942 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.966445923 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.966519117 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.966661930 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.966820955 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.989064932 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.989135027 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.989187002 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.989295006 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.989325047 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.989396095 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.989396095 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.989434004 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.989517927 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.989629030 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.989800930 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.989969969 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.990009069 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.990052938 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.990163088 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.990303040 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.990340948 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.990442991 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:39.990576982 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:39.990762949 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.012473106 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.012507915 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.012679100 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.012711048 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.012908936 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.012978077 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.013019085 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.013261080 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.013344049 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.013362885 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.013448000 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.013472080 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.013544083 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.013633966 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.013753891 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.013847113 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.013963938 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.014031887 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.014105082 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.014182091 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.014301062 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.014372110 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.014406919 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.014529943 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.014616013 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.014650106 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.014767885 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.014816046 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.014960051 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.015057087 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.015058994 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.018815994 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.035850048 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.035887957 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.035907030 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.036036015 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.036066055 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.036083937 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.036164045 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.036164045 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.036189079 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.036192894 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.036355972 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.036446095 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.036468029 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.036540031 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.036580086 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.036927938 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.037111044 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.037161112 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.037180901 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.037241936 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.037331104 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.037368059 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.037498951 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.037520885 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.037568092 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.037597895 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.037841082 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.037863016 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.037879944 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.037899971 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.037982941 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.038027048 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.041699886 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.041845083 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.059000969 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.059040070 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.059169054 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.059179068 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.059292078 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.059407949 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.059508085 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.059529066 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.059629917 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.059773922 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.059869051 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.059973955 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.059992075 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.060076952 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.060173035 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.060214996 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.060309887 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.060367107 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.060467958 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.060549021 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.060563087 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.060687065 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.060697079 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.060751915 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.060781002 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.061017990 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061052084 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.061122894 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.061271906 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061315060 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061363935 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.061388016 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061400890 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.061464071 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061482906 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061549902 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.061574936 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.061606884 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061667919 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061758995 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.061799049 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061817884 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061912060 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.061928034 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.061955929 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.061995983 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.064574957 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.064601898 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.064723015 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.064730883 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.064924002 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.082125902 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.082163095 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.082180977 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.082236052 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.082310915 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.082357883 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.082427979 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.082567930 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.082592010 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.082611084 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.082757950 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.082787991 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.082959890 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.082982063 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.083077908 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.083225012 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.083246946 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.083302021 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.083329916 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.083542109 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.083666086 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.083730936 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.083870888 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.084031105 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.084053993 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.084259987 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.084423065 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.084443092 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.084503889 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.084770918 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.084856987 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.084969997 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.085088968 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.085206032 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.085279942 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.085361958 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.085439920 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.085563898 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.085639954 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.085720062 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.085799932 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086111069 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086209059 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086237907 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086317062 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086396933 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086483955 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086563110 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086636066 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086798906 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086831093 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.086920977 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087049961 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087079048 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087295055 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087317944 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087347984 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087441921 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087565899 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087640047 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087908030 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087934017 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.087954044 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.088048935 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.088269949 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.088293076 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.088403940 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.088529110 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.088551044 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.088752985 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.088787079 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.088805914 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.088928938 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.089001894 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.089078903 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.089226007 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.089272976 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.089405060 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.105392933 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.105523109 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.105566978 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.105611086 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.105658054 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.105721951 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.105766058 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.105976105 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.106082916 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.106293917 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.106498003 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.106578112 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.106770039 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.106808901 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.106961012 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.107017040 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.107256889 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.107407093 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.107569933 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.120429039 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:40.121771097 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:40.194259882 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:41.217735052 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:41.217775106 CET	8081	49695	138.201.198.8	192.168.2.5
Mar 17, 2023 17:30:41.217863083 CET	49695	8081	192.168.2.5	138.201.198.8
Mar 17, 2023 17:30:55.966594934 CET	49695	8081	192.168.2.5	138.201.198.8

Target ID:	0
Start time:	17:29:18
Start date:	17/03/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x760000
File size:	5018112 bytes
MD5 hash:	D442830FC92DE9465D9BF425922173A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Aurora, Description: Yara Aurora Stealer, Source: 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	17:30:06
Start date:	17/03/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x1f0000
File size:	5018112 bytes
MD5 hash:	D442830FC92DE9465D9BF425922173A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	17:30:07
Start date:	17/03/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0xf0000
File size:	5018112 bytes
MD5 hash:	D442830FC92DE9465D9BF425922173A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	17:30:07
Start date:	17/03/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x840000
File size:	5018112 bytes
MD5 hash:	D442830FC92DE9465D9BF425922173A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Aurora, Description: Yara Aurora Stealer, Source: 00000003.00000002.483930551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	17:30:09
Start date:	17/03/2023
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic os get Caption
Imagebase:	0x3c0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	17:30:09
Start date:	17/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	17:30:11
Start date:	17/03/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /C "wmic path win32_VideoController get name"
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	17:30:11
Start date:	17/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	10
Start time:	17:30:11
Start date:	17/03/2023
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x3c0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	11
Start time:	17:30:17
Start date:	17/03/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /C "wmic cpu get name"
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	12
Start time:	17:30:17
Start date:	17/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	13
Start time:	17:30:17
Start date:	17/03/2023
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic cpu get name
Imagebase:	0x3c0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.3%
Total number of Nodes:	304
Total number of Limit Nodes:	28

Executed Functions

Function 0143A2A8 Relevance: .7, Instructions: 656COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6697238e62fa738da85bfe83d5e58fd0906ede5ad2c81863be94aea9ffdff765
Instruction ID: 25c58ae1e64078a1e501371daf861f65aa7d5bbb629c3931b7955fbc341720a2
Opcode Fuzzy Hash: 6697238e62fa738da85bfe83d5e58fd0906ede5ad2c81863be94aea9ffdff765
Instruction Fuzzy Hash: 6A529031A40619CFCB15CF58C884AAEB7B2FF88314F6584AAD949EB261D770FD85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 054C9F4B Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.440079822.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e8d06a9cade6b25645625b999225fe7108e091343611d8e8308128b3d11a86
Instruction ID: 888a9df0640bdaf488695a7caa6bdacc4fa4d0b115f7e689afb063d4243c6513
Opcode Fuzzy Hash: 01e8d06a9cade6b25645625b999225fe7108e091343611d8e8308128b3d11a86
Instruction Fuzzy Hash: 6DE15234B00219DFDB54DFA9C855BAEBBF2BF84700F1481AAE5069B395DB75AC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0143BE0C Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f97d08578d918c7d02040c043e7cf9de4642f88f0b2424dd9673ae245ae16c
Instruction ID: 039625d8147f8f2f5e7b217160b4a4fd9e3c06fc7685b05309ec070decedd9c2
Opcode Fuzzy Hash: 80f97d08578d918c7d02040c043e7cf9de4642f88f0b2424dd9673ae245ae16c
Instruction Fuzzy Hash: 0D916135E0031ADFCB04DBA4D8549DEBBB6FF99314F14861AE516AB3A4EB30A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0143EC10 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9319a644b4b52b096ed2d93e207a6355ddfdae2634a1c6062bc99ebea735b734
Instruction ID: 55a4da5188f020b208b6646c50f9ca6b36cbcd0631660b112e9ae27d845c24c1
Opcode Fuzzy Hash: 9319a644b4b52b096ed2d93e207a6355ddfdae2634a1c6062bc99ebea735b734
Instruction Fuzzy Hash: 73818235E0031ADFCB04DBA4D8849DEBB7AFFD9310F148615E516AB3A4EB30A945DB50

Uniqueness

Uniqueness Score: -1.00%

Function 054CC621 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.440079822.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327f4808bb32d9be30e0f0c2041f5da1f5b1668ff30acf35b6759f5abe6ab342
Instruction ID: b5db17f3808e6942ffb70c25d053704515c5950485b8b8de240bb6a0c5ec72b2
Opcode Fuzzy Hash: 327f4808bb32d9be30e0f0c2041f5da1f5b1668ff30acf35b6759f5abe6ab342
Instruction Fuzzy Hash: 93418F1A176E441BC5F5436B8DEB3C73E60F982214BEE71CB84A8C6F55E604C982D9CB

Uniqueness

Uniqueness Score: -1.00%

Function 01437828 Relevance: 6.1, APIs: 4, Instructions: 125
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01437898
GetCurrentThread.KERNEL32 ref: 014378D5
GetCurrentProcess.KERNEL32 ref: 01437912
GetCurrentThreadId.KERNEL32 ref: 0143796B

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fbe5b77d390728d6c10e91b28887c989d865d3bf779551a26629470ac0ece7d1
Instruction ID: c18920019744fc5e0d5d470c0c759d1f600418ff047a75b627781c719ada5e6f
Opcode Fuzzy Hash: fbe5b77d390728d6c10e91b28887c989d865d3bf779551a26629470ac0ece7d1
Instruction Fuzzy Hash: D35102B09002498FDB18CFAAC588BDEBFF1FF88314F24856AE449A73A1D7345844CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01437838 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01437898
GetCurrentThread.KERNEL32 ref: 014378D5
GetCurrentProcess.KERNEL32 ref: 01437912
GetCurrentThreadId.KERNEL32 ref: 0143796B

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 995ab2e62a72e6e2c22512001b5e472d9a897f2646b35caa0071c1cd0bf71e94
Instruction ID: 1ce748b7182ee049ae75e20a77c2484071f3aee9677b401184b2d11cd34e22f8
Opcode Fuzzy Hash: 995ab2e62a72e6e2c22512001b5e472d9a897f2646b35caa0071c1cd0bf71e94
Instruction Fuzzy Hash: DD5124B09002498FDB18CFAAC548BDEBFF1BF88314F20856AE449A73A1D7345844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0143C859 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0143CAAE

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cd5d89e6a8b3038141cd179e5f141682aeae887de1a811cc1d002e46a4d80b45
Instruction ID: 04d1f8f1288b28d016f047efec515fab10558e52de3e33596aae617c08a486f7
Opcode Fuzzy Hash: cd5d89e6a8b3038141cd179e5f141682aeae887de1a811cc1d002e46a4d80b45
Instruction Fuzzy Hash: B67125B1A00B058FD764DF2AD19075BBBF1BF88214F10892ED48AE7B50DB35E8068B91

Uniqueness

Uniqueness Score: -1.00%

Function 054C3128 Relevance: 1.7, APIs: 1, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 054C4291

Memory Dump Source

Source File: 00000000.00000002.440079822.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f2acd93697c308ce2ba722f2ea3cb74b035b11266edafbf2d247dd3e401bf810
Instruction ID: 6bc9d56557d43fb8daeddcd58a6b44bf62e513117213c24fa183bdc2b6518325
Opcode Fuzzy Hash: f2acd93697c308ce2ba722f2ea3cb74b035b11266edafbf2d247dd3e401bf810
Instruction Fuzzy Hash: 927186718043588FDB20DFA9C898BCEBFF1BF48314F2484AAD449AB251D7749885CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0143E90D Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0143EA2A

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 124cc8a4fca200f7600a5475db7cf10a09172c9fbeedd1516c4634a6860cd95f
Instruction ID: 9d24e65b8c8cf9e1317055671deb0f62570b96246491c5b59798e06071aec378
Opcode Fuzzy Hash: 124cc8a4fca200f7600a5475db7cf10a09172c9fbeedd1516c4634a6860cd95f
Instruction Fuzzy Hash: 5151B0B1D013199FDB14CF9AC884ADEBFB5FF88710F24852AE519AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0143E918 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0143EA2A

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5ff362996b036fb277a09b5fd3f8d3cbbcf3c4e983db94b30b3b26b938281576
Instruction ID: 7318b36fd7418520611f980e1453ea3f6270ec4a88213f6e4a6f518eb159b5a6
Opcode Fuzzy Hash: 5ff362996b036fb277a09b5fd3f8d3cbbcf3c4e983db94b30b3b26b938281576
Instruction Fuzzy Hash: 1841B0B1D01309DFDB14CF9AC884ADEBFB5BF88710F24852AE419AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 014379E9 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01437AE7

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f6d422c62c6d6f03188fe3f7008f23d6c56ee6122ec3d72e5f412e58a62a5244
Instruction ID: c5e2ba6f1b0f1bf0696fd7638113a4712ae9fd2b29d1f6799c18217887b33785
Opcode Fuzzy Hash: f6d422c62c6d6f03188fe3f7008f23d6c56ee6122ec3d72e5f412e58a62a5244
Instruction Fuzzy Hash: A9414AB6900209AFDB01CF99D844ADEBFF5FB88320F14802AF955A7361C7399955DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 054C41D4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 054C4291

Memory Dump Source

Source File: 00000000.00000002.440079822.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0b3c29e5e8a660a766d4498b6cfa42e91f4ffc0edc80d9a514cdc4861f1338c9
Instruction ID: 84f4fb9dbeac1826ccc1d807deff53435757e8b20baba0a980a5888be36cf2c6
Opcode Fuzzy Hash: 0b3c29e5e8a660a766d4498b6cfa42e91f4ffc0edc80d9a514cdc4861f1338c9
Instruction Fuzzy Hash: 0841F671C00729CFDB14CF99C945BCEBBB1BF88305F20849AD409AB255D7B55946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 054C310C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 054C4291

Memory Dump Source

Source File: 00000000.00000002.440079822.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c3b9e7fc0d77e50ef07aa67bd37a36d2b61d33bfdc75075e54a532c3dd02f3ad
Instruction ID: ce4960c0567b50db6f83d01cfd3f81b87e26164d571aec5a834bf21a3b56dfe0
Opcode Fuzzy Hash: c3b9e7fc0d77e50ef07aa67bd37a36d2b61d33bfdc75075e54a532c3dd02f3ad
Instruction Fuzzy Hash: 5441F574C00328CFDB24DF99C948BDEBBB1BF88305F6084AAD409AB255D7B55946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 054C10E0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 054C11A1

Memory Dump Source

Source File: 00000000.00000002.440079822.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 93048b0cb5a63e90b2be44cdb62bd3def2b52697a20ca96bf73ca520a7cff925
Instruction ID: cc9eb8dc6d7ba396453426ec5bebf4d9cee19f1a9e957dbd1478de3e8f000ec8
Opcode Fuzzy Hash: 93048b0cb5a63e90b2be44cdb62bd3def2b52697a20ca96bf73ca520a7cff925
Instruction Fuzzy Hash: 74411BB9A002059FCB54CF99C848AAABFF5FF8C314F24859DD419A7321D734A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0143EB20 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0143EBBD

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f7dbb7f2173b8c77b579675c68bedcd1c9221867f70dc0ec5cf55e89d7c828f4
Instruction ID: 5dc2b19e04b0c177dd6ba8f85e28bf388bddd376c1f35ccfe4d1c7ca1d0397bb
Opcode Fuzzy Hash: f7dbb7f2173b8c77b579675c68bedcd1c9221867f70dc0ec5cf55e89d7c828f4
Instruction Fuzzy Hash: A72169B5800249DFDB11CFA5D945BCABBF4FB48324F18845AD455B7251C338A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01437A60 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01437AE7

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3b68d3e6257867548541815ae7d28fa6f219bfbf383cba0f9314a487b5e4e219
Instruction ID: 6ed2428150e2edab0d31b725bc387bcef9f26125358312f21c1108414182003d
Opcode Fuzzy Hash: 3b68d3e6257867548541815ae7d28fa6f219bfbf383cba0f9314a487b5e4e219
Instruction Fuzzy Hash: 0321C2B59002099FDB10CFAAD984ADEBFF8FB48320F14841AE954B7350D374AA55CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0143BC80 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0143CB29,00000800,00000000,00000000), ref: 0143CD3A

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ae90b81d21b55a2c4d612f270d563b4ddd31d348796fd5b2572ed8859e2b40e4
Instruction ID: 36a591eeccde5f3cff4d2deefef3babab675994ec2e1e55b313fce3397870f62
Opcode Fuzzy Hash: ae90b81d21b55a2c4d612f270d563b4ddd31d348796fd5b2572ed8859e2b40e4
Instruction Fuzzy Hash: 681103B69002098FDB10CF9AC488ADEFBF4EB88320F10852AE515B7350C378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0143CCC9 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0143CB29,00000800,00000000,00000000), ref: 0143CD3A

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fabdeeae9934cd7d9fbf4249ab6d9f04442f381387d812672023cf7dbebc577d
Instruction ID: 420cf7813296f475d666fd7dc8b721e8b5fed60216d9fa623cf44eae51632e2d
Opcode Fuzzy Hash: fabdeeae9934cd7d9fbf4249ab6d9f04442f381387d812672023cf7dbebc577d
Instruction Fuzzy Hash: 6011E4B69002098FDB10CF9AD588BDEFBF4BB88720F14851AE515B7710C378A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0143CA48 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0143CAAE

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7e53ef6aebbf35a2d10b6941a5cc691eb180be2e4b4fac82ae75e9d16b2b2e75
Instruction ID: 80ad84bd6c3511ac9fe95f7e965f627e2c7428d84b026cbf9d3d3b21df677156
Opcode Fuzzy Hash: 7e53ef6aebbf35a2d10b6941a5cc691eb180be2e4b4fac82ae75e9d16b2b2e75
Instruction Fuzzy Hash: AB11DFB6D002498FDB10DF9AC484BDEFBF4AB88324F14856AD919B7710C375A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0143BDF4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0143EBBD

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 88610ed349af488ffb9ff335c320288040c53c09f5967e041b55e313684ef723
Instruction ID: ce7699eb8504ccd13a3b2df20dc1bd7bc2290d028735ae5e43380407bc79a70a
Opcode Fuzzy Hash: 88610ed349af488ffb9ff335c320288040c53c09f5967e041b55e313684ef723
Instruction Fuzzy Hash: 2311F2B59002099FDB10CF9AD588BDEBBF8EB88320F20855AE955B7350C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 013DD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.418796725.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bb1ec22a300d1584c988e2b696c8aac9f5ccc61646838f96bd87c501dc44e7
Instruction ID: 6e89104bf6f8c7b1831a1b0a2462e7225cc0ffdf1218f4a54dcd5f6b7ea6a85f
Opcode Fuzzy Hash: b8bb1ec22a300d1584c988e2b696c8aac9f5ccc61646838f96bd87c501dc44e7
Instruction Fuzzy Hash: 092145B2504244EFDB01DF98E9C0B66BF75FB84328F20C669E8091B686C736E446C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 013ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.418896214.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ed000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f33935e7c3c1338752861a4a63d8a2f6cac885178656a0961b21213916c83f
Instruction ID: 0635c439a75eb68e6e5d285ced1b117935a2ca21ee9b759a950dfd684a620453
Opcode Fuzzy Hash: 92f33935e7c3c1338752861a4a63d8a2f6cac885178656a0961b21213916c83f
Instruction Fuzzy Hash: 9D210071604344DFDB15CF58D8C8B16BFA5FB84358F28C969E80A0B686C336D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 013ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.418896214.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ed000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9feece840d27dadf7632b839bb2e2a31068cdef8126c583c91c1e25017818f76
Instruction ID: c26076f6f5aaefc66cbd6c03d1cb0473a9fef2b2d1b2c778f2146aca101905b6
Opcode Fuzzy Hash: 9feece840d27dadf7632b839bb2e2a31068cdef8126c583c91c1e25017818f76
Instruction Fuzzy Hash: 37213771504344DFDB01CF98D9C4B16BBE5FB84328F20CA6DE8094B286C336D846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 013DD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.418796725.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531ddb34ecaff0d19ee21c8da9a43450f91a2f213ab6685f60bae35d54da008c
Instruction ID: c2d5a069022cb403013ea6c8ac58eb4d00a88725b4e0763a29207441bf588af4
Opcode Fuzzy Hash: 531ddb34ecaff0d19ee21c8da9a43450f91a2f213ab6685f60bae35d54da008c
Instruction Fuzzy Hash: BE11E172404280CFCB02CF44D5C0B56BF72FB84324F24C6A9D8091B656C33AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.418896214.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ed000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73071e64d649ca5068ecd82b75df080301da1af13b603cf74dd6d805c90ab014
Instruction ID: d0e377e8eca318dce1fb19ed6d1896cf83f4580a43014d53cc80e0c82d0652e5
Opcode Fuzzy Hash: 73071e64d649ca5068ecd82b75df080301da1af13b603cf74dd6d805c90ab014
Instruction Fuzzy Hash: 38118B75504280DFDB12CF54D6C4B15BBB1FB84328F28C6ADD8494B696C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 013ED017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.418896214.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ed000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73071e64d649ca5068ecd82b75df080301da1af13b603cf74dd6d805c90ab014
Instruction ID: 71df813be71b10d86b08afcb139c085357ce174484806a95c57dc1ef6890179e
Opcode Fuzzy Hash: 73071e64d649ca5068ecd82b75df080301da1af13b603cf74dd6d805c90ab014
Instruction Fuzzy Hash: 2B118E75504380DFDB12CF54D5D4B15BFA1FB44318F28C6A9D8494B696C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 013DD75D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.418796725.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff4c824d7a6cb10cfb8e5303110a238a520afa92fa33fb363a310e08e86b118
Instruction ID: 189d893d120fcfad30cac84a9a3d29a08b872102a951cdd771203cd546c51b5c
Opcode Fuzzy Hash: 4ff4c824d7a6cb10cfb8e5303110a238a520afa92fa33fb363a310e08e86b118
Instruction Fuzzy Hash: 5301A7725043C49EE7114E59EC84B66BFD8EF41768F19849AED091A286C3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 013DD6E7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.418796725.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bb1d8d0bf40a2bd18e854244162cc4276c0e9092fadd5157db0708a268eff8
Instruction ID: c9fb850f5130184f03d5575d6f23b3e4b560828ec1bb5c5e5271cd6f16c75e63
Opcode Fuzzy Hash: d8bb1d8d0bf40a2bd18e854244162cc4276c0e9092fadd5157db0708a268eff8
Instruction Fuzzy Hash: 4CF0F976200644AFD3248F0AD984C27FBADEBD4774719C59AE94A4B651C671EC42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 013DD75C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.418796725.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd282e6daa0aef008551581559a673260edc3d006c120689f1d2ce2faae0273b
Instruction ID: 263c82644ccf3346c852872f2ac942d54e007ef99007c383244a9eb414926811
Opcode Fuzzy Hash: bd282e6daa0aef008551581559a673260edc3d006c120689f1d2ce2faae0273b
Instruction Fuzzy Hash: D7F062724043849EE7158E1ADCC4B62FF98EB51734F18C59AED485B286C3789844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 013DD6D8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.418796725.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071bb9597a580e29a4047622db4152a411c4acec07046fbf7928fbdc93ef3509
Instruction ID: 347884a5db7b431f2b98a5288672a2c9ce1e7f059a20055cfe562d488674e8c1
Opcode Fuzzy Hash: 071bb9597a580e29a4047622db4152a411c4acec07046fbf7928fbdc93ef3509
Instruction Fuzzy Hash: A2F03C75104680AFD325CF05C984C22BFF9EB897607198489E8854B352C630FC42CF60

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0143CF50 Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f776fcfc4b87155281f6b240b257bacece40193cdd25bcfba188d231ce31535
Instruction ID: bd5ace3bfb574637d24b43b6e47580ad95e7ba3d955de6b7077b4f85c624342b
Opcode Fuzzy Hash: 4f776fcfc4b87155281f6b240b257bacece40193cdd25bcfba188d231ce31535
Instruction Fuzzy Hash: 6A5268B09C17068FD750CF5AE4881993BB1FBC5318BD08A29D2695F3A1D3B964EACF44

Uniqueness

Uniqueness Score: -1.00%

Function 0143A150 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.419114158.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcf74926a8258b9d269fe7953d8548c7aa9ef00fd350bb3fb4dc0c676db40c0
Instruction ID: f9e0d5d171d70dd2bdf00fe45cd5672c06773e6779c1c50786722e608eeaff68
Opcode Fuzzy Hash: 9fcf74926a8258b9d269fe7953d8548c7aa9ef00fd350bb3fb4dc0c676db40c0
Instruction Fuzzy Hash: A3A15F32E1061A8FCF19DFA5C8845DEBBB2FFC9300B15856BE905BB225DB31A955CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04F66614 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.439262009.0000000004F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54005dab4b4d9e0a61ba6bcdb12248d4326c4e096a2a29d58b58abf6df0aae3
Instruction ID: f6061c2e3172648d030930fd75020e30847641fe1b392146aeb119f8418bb183
Opcode Fuzzy Hash: e54005dab4b4d9e0a61ba6bcdb12248d4326c4e096a2a29d58b58abf6df0aae3
Instruction Fuzzy Hash: 16D1DA31C10A5ACADB10EFA8D99069DB7B1FFA5300F60CB9AD44937254EB706AC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F66618 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.439262009.0000000004F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d15a2f7d23869dc5bb3ebf9f4d345ed0dba39e603b17fba9a788354f24b80f22
Instruction ID: bd7b02884c53627d5c3e17643950e3365dba0a524025224a3557146d6ee1501b
Opcode Fuzzy Hash: d15a2f7d23869dc5bb3ebf9f4d345ed0dba39e603b17fba9a788354f24b80f22
Instruction Fuzzy Hash: EAD1DA31C10A5ACADB10EFA8D99069DB7B1FFA5300F60CB9AD44937254EB706AC5CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: file.exePID: 1380, Parent PID: 2284COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 00464EC0 Relevance: 1.5, APIs: 1, Instructions: 30
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWaitableTimer.KERNELBASE ref: 00464F20

Memory Dump Source

Source File: 00000003.00000002.483930551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID: TimerWaitable
String ID:
API String ID: 1823812067-0
Opcode ID: 43243a5ce9209ec691a37365d00174ced0a718a8a10f1fda4638eb50b5a565e6
Instruction ID: 68cf8adaa6f0a896d15334c906564af00b864b26871925a692f0ccce58cd9893
Opcode Fuzzy Hash: 43243a5ce9209ec691a37365d00174ced0a718a8a10f1fda4638eb50b5a565e6
Instruction Fuzzy Hash: FF01E4B450C3018FC304DF08C59471ABBE1FB88714F108A2CE8994B391C776AA89CF97

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00433690 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.483930551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960357e6e197b8a5291eeae0200afb9afbdb455ff6c98889249dbfc893ea515b
Instruction ID: 9b05e038579827e142e79954e00647401c7d083e75c2f68764214cb5308f6bac
Opcode Fuzzy Hash: 960357e6e197b8a5291eeae0200afb9afbdb455ff6c98889249dbfc893ea515b
Instruction Fuzzy Hash: CA1184B56083028FC718DF24C59166FB7E1ABC8704F50D92EE4A587341E77D9A4ACB87

Uniqueness

Uniqueness Score: -1.00%

Function 0044A4E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.483930551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23301c06fdbc5d765302a85daf9a89c6a7866bf60acebdeacd56f2d797c00f89
Instruction ID: 1cc0792c4300fda987a9e124046f65084724d3ad56d4d355d85128d94e644500
Opcode Fuzzy Hash: 23301c06fdbc5d765302a85daf9a89c6a7866bf60acebdeacd56f2d797c00f89
Instruction Fuzzy Hash: 58F065B0804601DFDB14FF24D58176977F1FB84308F40492ED45947761E77A9595CB07

Uniqueness

Uniqueness Score: -1.00%

Function 00464E80 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.483930551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76cf7af6b34a0ed7d528a5fb49de0d268b971dcc157032501d21460dc3f171f4
Instruction ID: fa8d26d5596d40ed7fdf7b2a13fcf2f655f92cb5beab767a1fad48ee62559df5
Opcode Fuzzy Hash: 76cf7af6b34a0ed7d528a5fb49de0d268b971dcc157032501d21460dc3f171f4
Instruction Fuzzy Hash: 77E0B6B04183419BC310EF0CC88110ABBE0BB84220F508B5DA8B8473A1D33095088B92

Uniqueness

Uniqueness Score: -1.00%

Function 004640F0 Relevance: .0, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004640F0(intOrPtr __eax, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {

				asm("rdtsc");
				_a4 = __eax;
				_a8 = __edx;
				return __eax;
			}

0x0046410d
0x004640fe
0x00464102
0x00464106

Memory Dump Source

Source File: 00000003.00000002.483930551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7700c86727a3f7adf946e1b86aec0dcbef5ad3defbcffb90b65937c4e9bda6d9
Instruction ID: a57f8d75f24581a2d508043b5438e8e17eb3c9cb30d431931d957d40f87f85f0
Opcode Fuzzy Hash: 7700c86727a3f7adf946e1b86aec0dcbef5ad3defbcffb90b65937c4e9bda6d9
Instruction Fuzzy Hash: 21B012B040E3319D8B40CF04810015579D096C4780F20C42FA04D47104E23840817B0B

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Aurora

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\CoaNatyyiNKAReKJyiXJrscctNswYNsG

C:\Users\user\AppData\Local\Temp\EFfRsWxPLD

C:\Users\user\AppData\Local\Temp\MRAjWwhTHctcuAxhxKQFDaFpLSjFbcXo

C:\Users\user\AppData\Local\Temp\XVlBzgbaiC

C:\Users\user\AppData\Local\Temp\aFetHsbZRjxAwnwekrBEmfdzdcEkXBAk

C:\Users\user\AppData\Local\Temp\jQZLCtTMtT

C:\Users\user\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

C:\Users\user\AppData\Local\Temp\zpfRFEgmot

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
file.exe

Function 01437828 Relevance: 6.1, APIs: 4, Instructions: 125
threadCOMMON

Function 01437838 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 0143C859 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 054C3128 Relevance: 1.7, APIs: 1, Instructions: 183
COMMON

Function 0143E90D Relevance: 1.6, APIs: 1, Instructions: 116
COMMON