Edit tour

Windows Analysis Report
Vsob3IooE7.exe

Overview

General Information

Sample Name:	Vsob3IooE7.exe
Original Sample Name:	e7bf9f0c2c1977ddd8e139c13c27be0d.exe
Analysis ID:	873923
MD5:	e7bf9f0c2c1977ddd8e139c13c27be0d
SHA1:	e91aff3d9a8c7cef0e9543350864971e4ad93f82
SHA256:	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba
Tags:	32CoinMinerexe
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Yara detected AntiVM3

Sigma detected: Drops script at startup location

Multi AV Scanner detection for dropped file

Sigma detected: Xmrig

Found strings related to Crypto-Mining

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Detected Stratum mining protocol

Machine Learning detection for sample

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

IP address seen in connection with other malware

Entry point lies outside standard sections

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Binary contains a suspicious time stamp

Creates a start menu entry (Start Menu\Programs\Startup)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

Vsob3IooE7.exe (PID: 1796 cmdline: C:\Users\user\Desktop\Vsob3IooE7.exe MD5: E7BF9F0C2C1977DDD8E139C13C27BE0D)

Vsob3IooE7.exe (PID: 5184 cmdline: {path} MD5: E7BF9F0C2C1977DDD8E139C13C27BE0D)

Vsob3IooE7.exe (PID: 6944 cmdline: {path} MD5: E7BF9F0C2C1977DDD8E139C13C27BE0D)

Vsob3IooE7.exe (PID: 748 cmdline: {path} MD5: E7BF9F0C2C1977DDD8E139C13C27BE0D)

Driver.exe (PID: 6784 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 2 MD5: 02569A7A91A71133D4A1023BF32AA6F4)

conhost.exe (PID: 5692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Vsob3IooE7.exe (PID: 5664 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe" MD5: E7BF9F0C2C1977DDD8E139C13C27BE0D)

Vsob3IooE7.exe (PID: 2068 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe" MD5: E7BF9F0C2C1977DDD8E139C13C27BE0D)

Vsob3IooE7.exe (PID: 5176 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe" MD5: E7BF9F0C2C1977DDD8E139C13C27BE0D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	URL_File_Local_EXE	Detects an .url file that points to a local executable	Florian Roth (Nextron Systems)	0x0:$s1: [InternetShortcut] 0x14:$s2: URL=file:///C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	Methodology_Suspicious_Shortcut_Local_URL	Detects local script usage for .URL persistence	@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)	0x14:$file: URL=file:/// 0x0:$url_explicit: [InternetShortcut]

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Vsob3IooE7.exe PID: 1796	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Vsob3IooE7.exe PID: 748	PUA_Crypto_Mining_CommandLine_Indicators_Oct21	Detects command line parameters often used by crypto mining software	Florian Roth (Nextron Systems)	0x561fa:$s03: -o pool. 0x56307:$s03: -o pool. 0x7a586:$s03: -o pool. 0x7a648:$s03: -o pool. 0x7ad12:$s03: -o pool. 0x82b19:$s03: -o pool. 0xd07cb:$s03: -o pool. 0xd08d8:$s03: -o pool. 0xe88a0:$s03: -o pool. 0x10c01c:$s03: -o pool. 0x10c127:$s03: -o pool. 0x144fec:$s03: -o pool.
Process Memory Space: Driver.exe PID: 6784	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Sigma Signatures

Bitcoin Miner

Sigma detected: Xmrig

Source: Process started

Author: Joe Security: Data: Command: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 2, CommandLine: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 2, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, NewProcessName: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, ParentCommandLine: {path}, ParentImage: C:\Users\user\Desktop\Vsob3IooE7.exe, ParentProcessId: 748, ParentProcessName: Vsob3IooE7.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 2, ProcessId: 6784, ProcessName: Driver.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Vsob3IooE7.exe, ProcessId: 748, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Vsob3IooE7.exe	ReversingLabs: Detection: 21%
Source: Vsob3IooE7.exe	Virustotal: Detection: 23%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

ReversingLabs: Detection: 70%

Machine Learning detection for sample

Source: Vsob3IooE7.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Driver.exe PID: 6784, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Driver.exe, 00000007.00000000.450719664.0000000140001000.00000080.00000001.01000000.0000000A.sdmp

String found in binary or memory: @cryptonight/0cn

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.5:49715 -> 141.94.96.144:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"427x8gux5jrrgk4v7grcwk85mwpjcan7djgqbabcetdqc5bivy27pept3ctx43qmladkaardf4kw4hiozmdq7ehrnczdnfm","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.

Source: Vsob3IooE7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Vsob3IooE7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Cassa.pdb source: Vsob3IooE7.exe, 00000000.00000002.430553510.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.430553510.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.574629753.0000000005A00000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Cassa.pdbSHA256 source: Vsob3IooE7.exe, 00000000.00000002.430553510.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.430553510.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.574629753.0000000005A00000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: ZMm7.pdbSHA256#:=v source: Vsob3IooE7.exe
Source:	Binary string: ZMm7.pdb source: Vsob3IooE7.exe

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h

0_2_02ECEC18

Source: Joe Sandbox View

IP Address: 141.94.96.144 141.94.96.144

Source: global traffic

TCP traffic: 192.168.2.5:49715 -> 141.94.96.144:3333

Source: Vsob3IooE7.exe	String found in binary or memory: http://)/cmd.cgi?cmd=REL
Source: Vsob3IooE7.exe	String found in binary or memory: http://192.168.100.115/cmd.cgi?
Source: Driver.exe.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: Driver.exe.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Driver.exe.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Driver.exe.5.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Driver.exe.5.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Driver.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: Driver.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Driver.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Driver.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Driver.exe.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: Driver.exe.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Driver.exe.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Driver.exe.5.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Driver.exe.5.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Driver.exe.5.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Driver.exe.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Driver.exe.5.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000006.00000002.448788250.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Vsob3IooE7.exe, 00000000.00000003.395584229.000000000626C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html(
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Driver.exe.5.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Vsob3IooE7.exe, 00000000.00000003.396117342.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.396175898.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Vsob3IooE7.exe, 00000000.00000003.396117342.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.396175898.000000000627A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: Vsob3IooE7.exe, 00000000.00000003.396117342.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.396175898.000000000627A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: Vsob3IooE7.exe, 00000000.00000003.398298313.0000000006278000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.424132747.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.398207029.0000000006278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: Vsob3IooE7.exe, 00000000.00000003.398298313.0000000006278000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.424132747.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.398207029.0000000006278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comue9
Source: Vsob3IooE7.exe, 00000000.00000003.396117342.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.396175898.000000000627A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comueTF
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Vsob3IooE7.exe, 00000000.00000003.394136612.0000000006265000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.394272189.000000000626A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Vsob3IooE7.exe, 00000000.00000003.397493268.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.397352751.000000000627A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Vsob3IooE7.exe, 00000000.00000003.424132747.0000000006260000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Vsob3IooE7.exe, 00000000.00000003.395007888.0000000006277000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/(w
Source: Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395584229.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/6w
Source: Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/://w
Source: Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Cw
Source: Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/X
Source: Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/
Source: Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Zw
Source: Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/hw
Source: Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/icro
Source: Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/Zw
Source: Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395584229.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395007888.0000000006277000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/r
Source: Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/~w
Source: Vsob3IooE7.exe, 00000000.00000003.397352751.000000000626C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Vsob3IooE7.exe, 00000000.00000003.391553068.000000000627B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comwdth
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Vsob3IooE7.exe, 00000000.00000003.396175898.000000000626C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: Vsob3IooE7.exe, 00000000.00000003.396175898.000000000626C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de9h
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Vsob3IooE7.exe, 00000000.00000003.396175898.000000000626C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deeg
Source: Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Driver.exe.5.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown

DNS traffic detected: queries for: pool.supportxmr.com

Source: Vsob3IooE7.exe, 00000000.00000002.424543381.0000000001229000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Vsob3IooE7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Process Memory Space: Vsob3IooE7.exe PID: 748, type: MEMORYSTR	Matched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url, type: DROPPED	Matched rule: URL_File_Local_EXE date = 2017-10-04, author = Florian Roth (Nextron Systems), description = Detects an .url file that points to a local executable, score = , reference = https://twitter.com/malwareforme/status/915300883012870144, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url, type: DROPPED	Matched rule: Methodology_Suspicious_Shortcut_Local_URL author = @itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson), description = Detects local script usage for .URL persistence, score = 27.09.2019, reference = https://twitter.com/cglyer/status/1176184798248919044

Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_015794A8	0_2_015794A8
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_0157C148	0_2_0157C148
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_0157A758	0_2_0157A758
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC0040	0_2_02EC0040
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC81D0	0_2_02EC81D0
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC8668	0_2_02EC8668
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC6DB0	0_2_02EC6DB0
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC33E8	0_2_02EC33E8
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC2BC8	0_2_02EC2BC8
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC33DA	0_2_02EC33DA
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC8BA8	0_2_02EC8BA8
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC2BB9	0_2_02EC2BB9
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC8B98	0_2_02EC8B98
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02ECBB78	0_2_02ECBB78
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC28C8	0_2_02EC28C8
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC28B9	0_2_02EC28B9
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC0006	0_2_02EC0006
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC81C0	0_2_02EC81C0
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC3188	0_2_02EC3188
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC3178	0_2_02EC3178
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC410A	0_2_02EC410A
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC4110	0_2_02EC4110
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02ECB628	0_2_02ECB628
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC3600	0_2_02EC3600
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC2F41	0_2_02EC2F41
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC2F50	0_2_02EC2F50
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02ECA4E8	0_2_02ECA4E8
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02ECA4D8	0_2_02ECA4D8
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC35F0	0_2_02EC35F0
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC6DA1	0_2_02EC6DA1
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC1D41	0_2_02EC1D41
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC1D50	0_2_02EC1D50

Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000326A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Vsob3IooE7.exe
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCassa.dll< vs Vsob3IooE7.exe
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.0000000003241000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCassa.dll< vs Vsob3IooE7.exe
Source: Vsob3IooE7.exe, 00000000.00000002.424543381.0000000001229000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Vsob3IooE7.exe
Source: Vsob3IooE7.exe, 00000000.00000000.387255397.0000000000A92000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZMm7.exe@ vs Vsob3IooE7.exe
Source: Vsob3IooE7.exe, 00000000.00000002.574629753.0000000005A00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCassa.dll< vs Vsob3IooE7.exe
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0 vs Vsob3IooE7.exe
Source: Vsob3IooE7.exe, 00000009.00000002.469097025.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Vsob3IooE7.exe
Source: Vsob3IooE7.exe, 0000000A.00000002.492222164.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Vsob3IooE7.exe
Source: Vsob3IooE7.exe	Binary or memory string: OriginalFilenameZMm7.exe@ vs Vsob3IooE7.exe

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe 8D6ABBA9B216172CFC64B8802DB0D20A1C634C96E1049F451EDDBA2363966BF0

Source: Vsob3IooE7.exe	ReversingLabs: Detection: 21%
Source: Vsob3IooE7.exe	Virustotal: Detection: 23%

Source: Vsob3IooE7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Vsob3IooE7.exe C:\Users\user\Desktop\Vsob3IooE7.exe
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\Desktop\Vsob3IooE7.exe {path}
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\Desktop\Vsob3IooE7.exe {path}
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\Desktop\Vsob3IooE7.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe "C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe"
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe "C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe "C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe"
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\Desktop\Vsob3IooE7.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\Desktop\Vsob3IooE7.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\Desktop\Vsob3IooE7.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 2	Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Vsob3IooE7.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.expl.evad.mine.winEXE@13/3@1/1

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: Vsob3IooE7.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Vsob3IooE7.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Vsob3IooE7.exe

Static file information: File size 2842624 > 1048576

Source: Vsob3IooE7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Vsob3IooE7.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2b5600

Source: Vsob3IooE7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Vsob3IooE7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Cassa.pdb source: Vsob3IooE7.exe, 00000000.00000002.430553510.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.430553510.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.574629753.0000000005A00000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Cassa.pdbSHA256 source: Vsob3IooE7.exe, 00000000.00000002.430553510.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.430553510.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.574629753.0000000005A00000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: ZMm7.pdbSHA256#:=v source: Vsob3IooE7.exe
Source:	Binary string: ZMm7.pdb source: Vsob3IooE7.exe

Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC086C pushad ; iretd		0_2_02EC086D
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Code function: 0_2_02EC8D7C pushfd ; ret		0_2_02EC8D85

Source: Driver.exe.5.dr	Static PE information: section name: .MPRESS1
Source: Driver.exe.5.dr	Static PE information: section name: .MPRESS2

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: Driver.exe.5.dr	Static PE information: real checksum: 0x3f8bb4 should be: 0x3fb52d
Source: Vsob3IooE7.exe	Static PE information: real checksum: 0x0 should be: 0x2c0932

Source: Vsob3IooE7.exe

Static PE information: 0xA019F57F [Fri Feb 12 14:36:47 2055 UTC]

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

File created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Driver			Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Driver			Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Vsob3IooE7.exe PID: 1796, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Vsob3IooE7.exe TID: 7152

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: Vsob3IooE7.exe, 00000005.00000003.807995083.0000000001476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}c-
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Vsob3IooE7.exe, 00000000.00000002.430553510.000000000325D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

Memory written: C:\Users\user\Desktop\Vsob3IooE7.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\Desktop\Vsob3IooE7.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\Desktop\Vsob3IooE7.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\Desktop\Vsob3IooE7.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 2	Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Users\user\Desktop\Vsob3IooE7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Users\user\Desktop\Vsob3IooE7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Queries volume information: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Queries volume information: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Vsob3IooE7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	21 Registry Run Keys / Startup Folder	111 Process Injection	1 Masquerading	1 Input Capture	21 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	21 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Timestomp	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
Vsob3IooE7.exe	22%	ReversingLabs
Vsob3IooE7.exe	24%	Virustotal	Browse
Vsob3IooE7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	71%	ReversingLabs	Win64.Trojan.DisguisedXMRigMiner

Source	Detection	Scanner	Label
http://www.jiyu-kobo.co.jp/://w	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/://w	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://)/cmd.cgi?cmd=REL	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/icro	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/X	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.urwpp.de9h	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comwdth	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/Zw	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.html(	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Cw	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/hw	0%	Avira URL Cloud	safe
http://www.fontbureau.comueTF	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.urwpp.deeg	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/r	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/6w	0%	Avira URL Cloud	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.fontbureau.comalic	0%	URL Reputation	safe
http://www.fontbureau.comue9	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/(w	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Zw	0%	Avira URL Cloud	safe
http://192.168.100.115/cmd.cgi?	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/~w	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool-fr.supportxmr.com	141.94.96.144	true	false		high
pool.supportxmr.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.jiyu-kobo.co.jp/://w	Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.comwdth	Vsob3IooE7.exe, 00000000.00000003.391553068.000000000627B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/hw	Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://)/cmd.cgi?cmd=REL	Vsob3IooE7.exe	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers?	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/Cw	Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Vsob3IooE7.exe, 00000000.00000003.424132747.0000000006260000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html(	Vsob3IooE7.exe, 00000000.00000003.395584229.000000000626C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/Zw	Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.de9h	Vsob3IooE7.exe, 00000000.00000003.396175898.000000000626C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.de	Vsob3IooE7.exe, 00000000.00000003.396175898.000000000626C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Vsob3IooE7.exe, 00000000.00000002.430553510.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000006.00000002.448788250.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/icro	Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/6w	Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395584229.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Vsob3IooE7.exe, 00000000.00000003.396117342.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.396175898.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/	Vsob3IooE7.exe, 00000000.00000003.397493268.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.397352751.000000000627A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/X	Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comF	Vsob3IooE7.exe, 00000000.00000003.396117342.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.396175898.000000000627A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/(w	Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comueTF	Vsob3IooE7.exe, 00000000.00000003.396117342.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.396175898.000000000627A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Zw	Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deeg	Vsob3IooE7.exe, 00000000.00000003.396175898.000000000626C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	Vsob3IooE7.exe, 00000000.00000003.394136612.0000000006265000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.394272189.000000000626A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.168.100.115/cmd.cgi?	Vsob3IooE7.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/Y0/	Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/r	Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395584229.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395007888.0000000006277000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.monotype.	Vsob3IooE7.exe, 00000000.00000003.397352751.000000000626C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Vsob3IooE7.exe, 00000000.00000003.395007888.0000000006277000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.como	Vsob3IooE7.exe, 00000000.00000003.398298313.0000000006278000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.424132747.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.398207029.0000000006278000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Vsob3IooE7.exe, 00000000.00000002.595110447.0000000007372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comalic	Vsob3IooE7.exe, 00000000.00000003.396117342.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.396175898.000000000627A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/~w	Vsob3IooE7.exe, 00000000.00000003.395375546.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395241732.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395186910.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.395078810.0000000006265000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comue9	Vsob3IooE7.exe, 00000000.00000003.398298313.0000000006278000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.424132747.000000000627A000.00000004.00000020.00020000.00000000.sdmp, Vsob3IooE7.exe, 00000000.00000003.398207029.0000000006278000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.94.96.144	pool-fr.supportxmr.com	Germany		680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	873923
Start date and time:	2023-05-23 16:29:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Vsob3IooE7.exe
Original Sample Name:	e7bf9f0c2c1977ddd8e139c13c27be0d.exe
Detection:	MAL
Classification:	mal100.expl.evad.mine.winEXE@13/3@1/1
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 88% Number of executed functions: 44 Number of non-executed functions: 24
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Execution Graph export aborted for target Vsob3IooE7.exe, PID 2068 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:30:18	API Interceptor	1x Sleep call for process: Vsob3IooE7.exe modified
16:30:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe
16:30:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe
16:30:46	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.94.96.144	GameBar.exe	Get hash	malicious	Xmrig	Browse
	FTrondtloadws.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	GoogleUpdate.exe	Get hash	malicious	Xmrig	Browse
	d.py	Get hash	malicious	PwnRig Miner	Browse
	PYnsVrS3EX.exe	Get hash	malicious	Xmrig	Browse
	DHL Original Documents.exe	Get hash	malicious	RHADAMANTHYS, Xmrig	Browse
	xxx.elf	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool-fr.supportxmr.com	ruZVRNvu0Y.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.71
	GameBar.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	FTrondtloadws.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	GoogleUpdate.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	KMSPicoSetup.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	WvWlWr2HC0.exe	Get hash	malicious	LoaderBot, RedLine, SmokeLoader, Vidar, Xmrig, zgRAT	Browse	141.94.96.144
	spread.exe	Get hash	malicious	ETERNALBLUE, Xmrig	Browse	141.94.96.144
	target.ps1	Get hash	malicious	Xmrig	Browse	141.94.96.144
	Activator.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	d.py	Get hash	malicious	PwnRig Miner	Browse	141.94.96.71
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.195
	PYnsVrS3EX.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	PYnsVrS3EX.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	RHADAMANTHYS, RedLine, Xmrig	Browse	141.94.96.71
	DHL ORIGINAL DOCUMENTS.exe	Get hash	malicious	RHADAMANTHYS, Xmrig	Browse	141.94.96.71
	DHL Original Documents.exe	Get hash	malicious	RHADAMANTHYS, Xmrig	Browse	141.94.96.144
	file.exe	Get hash	malicious	RHADAMANTHYS, Vidar, Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	PrivateLoader, RHADAMANTHYS, Xmrig	Browse	141.94.96.71

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	MTSpago3242142023.xls	Get hash	malicious	GuLoader	Browse	141.94.149.125
	D4EATj8S1c.elf	Get hash	malicious	Mirai, Moobot	Browse	141.9.112.43
	c7n8Y8b877.elf	Get hash	malicious	Unknown	Browse	212.201.156.65
	xyK0juuSuG.elf	Get hash	malicious	Mirai, Moobot	Browse	134.77.67.255
	ruZVRNvu0Y.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.195
	GameBar.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	SPL242523535252525235.xls	Get hash	malicious	FormBook	Browse	141.94.149.125
	feobBkGOei.elf	Get hash	malicious	Mirai	Browse	195.37.8.77
	VsAKb3sxAu.elf	Get hash	malicious	Mirai	Browse	141.65.230.90
	iHDZW6bttX.elf	Get hash	malicious	Mirai	Browse	193.174.13.220
	OBBVGwjkM1.elf	Get hash	malicious	Mirai	Browse	141.60.164.212
	FWcYZPr3YJ.elf	Get hash	malicious	Unknown	Browse	141.65.242.27
	p1FejiLL02.elf	Get hash	malicious	Mirai	Browse	130.183.198.220
	xoeNOJm8Gu.elf	Get hash	malicious	Unknown	Browse	130.183.251.24
	UiodpDMy4N.elf	Get hash	malicious	Unknown	Browse	141.9.224.167
	UI721.bin.exe	Get hash	malicious	AgentTesla, LockBit ransomware, LummaC Stealer, RedLine, TrojanRansom, zgRAT	Browse	141.94.149.125
	x86.elf	Get hash	malicious	Unknown	Browse	149.201.32.191
	P1sYDU1Ihc.elf	Get hash	malicious	Mirai, Moobot	Browse	134.28.97.169
	D9auh16sL0.elf	Get hash	malicious	Unknown	Browse	132.253.146.54
	yJNmeNWeST.elf	Get hash	malicious	Mirai, Moobot	Browse	193.174.114.255

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	ruZVRNvu0Y.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	WvWlWr2HC0.exe	Get hash	malicious	LoaderBot, RedLine, SmokeLoader, Vidar, Xmrig, zgRAT	Browse
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	8ulUl36eYw.exe	Get hash	malicious	Fabookie, ManusCrypt, PrivateLoader, Raccoon Stealer v2, RedLine, SmokeLoader, Tofsee	Browse
	file.exe	Get hash	malicious	RedLine, Xmrig	Browse
	2CH4QX76nU.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	mQRqXgFxJR.exe	Get hash	malicious	LoaderBot Xmrig	Browse
	tIH5DUSVGF.exe	Get hash	malicious	LoaderBot Xmrig	Browse
	rnFMPDf3RV.exe	Get hash	malicious	LoaderBot RedLine Xmrig	Browse
	VJO8DJVqC0.exe	Get hash	malicious	LoaderBot Xmrig	Browse
	lcDlB6uuzr.exe	Get hash	malicious	LoaderBot RedLine Xmrig	Browse
	3Yfr0pHudU.exe	Get hash	malicious	LoaderBot Xmrig	Browse
	5622_1647967473_729.exe	Get hash	malicious	Xmrig	Browse
	2862_1647970205_130.exe	Get hash	malicious	Xmrig	Browse
	SGH9m3w8Hx.exe	Get hash	malicious	Xmrig	Browse
	WQw4XERnFl.exe	Get hash	malicious	Xmrig	Browse
	8vprKeDXuJ.exe	Get hash	malicious	RedLine Xmrig	Browse
	4nmeEJrZJ9.exe	Get hash	malicious	Phoenix Stealer Xmrig	Browse
	DmpOiwahZV.exe	Get hash	malicious	RedLine Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Vsob3IooE7.exe.log

Download File

Process:	C:\Users\user\Desktop\Vsob3IooE7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Download File

Process:	C:\Users\user\Desktop\Vsob3IooE7.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:///C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	5.0924278210562015
Encrypted:	false
SSDEEP:	3:HRAbABGQYm5uOUkh4EaKC5SQnRrF0rIJ4ovstwWDUWJRWz9F06kiWXU:HRYFVmwO9aZ5lZGEJlvstwWDNJAZG6kW
MD5:	47B8F4176A78D858A4ABE8C9DC2FCA69
SHA1:	6EF87AC0E0944352F520E48FBBDC944F8D91AC90
SHA-256:	794E872B8C7B8C2B8D9199EAD7C66F39DA421F3C54A816DCD6C696F45E6BCEB0
SHA-512:	951118DDE1499EAEFDDD6A282FCC58BA71688E9F72F93820FBA24CF6298CB85D53E5903AE12D0DDE50C2D9D476C8C46CC94A79B796C9052CEDDF0655D83CF5F7
Malicious:	true
Yara Hits:	Rule: URL_File_Local_EXE, Description: Detects an .url file that points to a local executable, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url, Author: Florian Roth (Nextron Systems) Rule: Methodology_Suspicious_Shortcut_Local_URL, Description: Detects local script usage for .URL persistence, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url, Author: @itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)
Reputation:	low
Preview:	[InternetShortcut]..URL=file:///C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe..IconIndex=0..IconFile=C:\Users\user\Desktop\Vsob3IooE7.exe\backup (3).ico..

C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

Download File

Process:	C:\Users\user\Desktop\Vsob3IooE7.exe
File Type:	MS-DOS executable PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4141064
Entropy (8bit):	5.210440836800201
Encrypted:	false
SSDEEP:	49152:SNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3Z:wzP88fBsnZTgOtqB3m1RC3Z
MD5:	02569A7A91A71133D4A1023BF32AA6F4
SHA1:	0F16BCB3F3F085D3D3BE912195558E9F9680D574
SHA-256:	8D6ABBA9B216172CFC64B8802DB0D20A1C634C96E1049F451EDDBA2363966BF0
SHA-512:	534BE1FE93EE556A14CFD8FAD5377F57FB056AB4CD2BCA14E4F376F4A25D3D4D270917D68A90B3C40D8A8DAAEBA6F592FA095ECFF478332BA23405D1DF728322
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Joe Sandbox View:	Filename: ruZVRNvu0Y.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: WvWlWr2HC0.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 8ulUl36eYw.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 2CH4QX76nU.exe, Detection: malicious, Browse Filename: mQRqXgFxJR.exe, Detection: malicious, Browse Filename: tIH5DUSVGF.exe, Detection: malicious, Browse Filename: rnFMPDf3RV.exe, Detection: malicious, Browse Filename: VJO8DJVqC0.exe, Detection: malicious, Browse Filename: lcDlB6uuzr.exe, Detection: malicious, Browse Filename: 3Yfr0pHudU.exe, Detection: malicious, Browse Filename: 5622_1647967473_729.exe, Detection: malicious, Browse Filename: 2862_1647970205_130.exe, Detection: malicious, Browse Filename: SGH9m3w8Hx.exe, Detection: malicious, Browse Filename: WQw4XERnFl.exe, Detection: malicious, Browse Filename: 8vprKeDXuJ.exe, Detection: malicious, Browse Filename: 4nmeEJrZJ9.exe, Detection: malicious, Browse Filename: DmpOiwahZV.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d......^.........."...........k.....N2.........@.............................P........?... ..................................................0..P....@..../...W.......>..:...........................................................0...............................MPRESS1. ...............................MPRESS2.....0...........................rsrc...../..@..../.................@..............................................................v2.19..L...H...(.@.......H.......H.....`..f.@....H....O..H..(..0...&......*.....4%. 0.h. <...W..3.3.A...(.....1(.....0 ...0@.......`..N..Q.......w.....3.H...]K..X.ev.u. [.? L._.k\...........G..q\....Q..@. ......_0...+.........!.8..X0.W....t.".I.%. .. .............~.....~....S.~Cp.W:~..................O.A ...p\........L..`..O..........3.i.e...lA..A.....H...I;..\|.....O=.p....-..........3..K/.. ~.@.Q0G.."...Q......)..(..".!......@..P.)...%O.H.1......X0......G.X.XP....^Q..5\|^2.E

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.8010200183533485
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Vsob3IooE7.exe
File size:	2842624
MD5:	e7bf9f0c2c1977ddd8e139c13c27be0d
SHA1:	e91aff3d9a8c7cef0e9543350864971e4ad93f82
SHA256:	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba
SHA512:	d9961824b178944aec2411c1bb29a5ef4b487ce0c251fe381e2841c6abe00f29ecf895ab1baf93e49442af07a14acdcf9d882519d39beb5c4d4902db2db2560f
SSDEEP:	49152:552sxwTr/VsoJteujcnqNwelN/z52r7zj9n0cqv/3SYd:55jxa3JteujcncNNQzj9hqXCY
TLSH:	A9D5CF7C86B50EB7D0F7C7E457C4B817BAADAB33B10C9A2145D2439D026F96224DE42E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................P..V+.........2t+.. ....+...@.. ........................+...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x6b7432
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA019F57F [Fri Feb 12 14:36:47 2055 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b73df	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2b8000	0x5b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2ba000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b4fa0	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2b5438	0x2b5600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2b8000	0x5b4	0x600	False	0.4231770833333333	data	4.100599837122123	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2ba000	0xc	0x200	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x2b8090	0x324	data
RT_MANIFEST	0x2b83c4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2023 16:30:42.966169119 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:30:42.985848904 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:30:42.986406088 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:30:43.065582991 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:30:43.085134029 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:30:43.085624933 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:30:43.282708883 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:30:56.877768993 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:30:57.080768108 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:31:01.491835117 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:31:01.581163883 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:31:03.776058912 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:31:03.880321026 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:31:13.896189928 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:31:13.980247021 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:31:25.782275915 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:31:25.880122900 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:31:37.728445053 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:31:37.885164976 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:31:47.966363907 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:31:48.182876110 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:31:56.923937082 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:31:57.074263096 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:31:59.201129913 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:31:59.387062073 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:32:10.388082981 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:32:10.575385094 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:32:21.562840939 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:32:21.686986923 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:32:36.864428043 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:32:37.077795029 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:32:51.504137993 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:32:51.578978062 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:32:51.696830988 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:32:51.716387033 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:32:51.738040924 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:32:51.891436100 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:32:56.988322020 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:32:57.079406023 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:33:01.595695019 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:33:01.689155102 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:33:11.628896952 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:33:11.690028906 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:33:22.149544954 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:33:22.190901995 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:33:34.855365038 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:33:34.895766020 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:33:35.652163029 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:33:35.895600080 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:33:46.998639107 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:33:47.083633900 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:33:54.681701899 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:33:54.896764040 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:33:57.031797886 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:33:57.084539890 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:34:04.661757946 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:34:04.912950993 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:34:17.348527908 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:34:17.398740053 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:34:27.696890116 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:34:27.915334940 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:34:30.048935890 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:34:30.196691036 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:34:43.032084942 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:34:43.088433027 CEST	49715	3333	192.168.2.5	141.94.96.144
May 23, 2023 16:34:53.160926104 CEST	3333	49715	141.94.96.144	192.168.2.5
May 23, 2023 16:34:53.401909113 CEST	49715	3333	192.168.2.5	141.94.96.144

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2023 16:30:42.908279896 CEST	51441	53	192.168.2.5	8.8.8.8
May 23, 2023 16:30:42.943305969 CEST	53	51441	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2023 16:30:42.908279896 CEST	192.168.2.5	8.8.8.8	0x1db3	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 23, 2023 16:30:42.943305969 CEST	8.8.8.8	192.168.2.5	0x1db3	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
May 23, 2023 16:30:42.943305969 CEST	8.8.8.8	192.168.2.5	0x1db3	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
May 23, 2023 16:30:42.943305969 CEST	8.8.8.8	192.168.2.5	0x1db3	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
May 23, 2023 16:30:42.943305969 CEST	8.8.8.8	192.168.2.5	0x1db3	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	16:30:09
Start date:	23/05/2023
Path:	C:\Users\user\Desktop\Vsob3IooE7.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Vsob3IooE7.exe
Imagebase:	0xa90000
File size:	2842624 bytes
MD5 hash:	E7BF9F0C2C1977DDD8E139C13C27BE0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	16:30:23
Start date:	23/05/2023
Path:	C:\Users\user\Desktop\Vsob3IooE7.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x250000
File size:	2842624 bytes
MD5 hash:	E7BF9F0C2C1977DDD8E139C13C27BE0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	16:30:23
Start date:	23/05/2023
Path:	C:\Users\user\Desktop\Vsob3IooE7.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x180000
File size:	2842624 bytes
MD5 hash:	E7BF9F0C2C1977DDD8E139C13C27BE0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	5
Start time:	16:30:23
Start date:	23/05/2023
Path:	C:\Users\user\Desktop\Vsob3IooE7.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x9b0000
File size:	2842624 bytes
MD5 hash:	E7BF9F0C2C1977DDD8E139C13C27BE0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	16:30:35
Start date:	23/05/2023
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe"
Imagebase:	0x8f0000
File size:	2842624 bytes
MD5 hash:	E7BF9F0C2C1977DDD8E139C13C27BE0D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	7
Start time:	16:30:39
Start date:	23/05/2023
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 427X8guX5JRRGk4v7gRcwK85MwpjCAN7djGqBAbCETdqc5biVY27pePT3Ctx43QMLAdKAaRDF4KW4HiozmdQ7EHrNczdnfM -p x -k -v=0 --donate-level=1 -t 2
Imagebase:	0x140000000
File size:	4141064 bytes
MD5 hash:	02569A7A91A71133D4A1023BF32AA6F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Target ID:	8
Start time:	16:30:41
Start date:	23/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	16:30:45
Start date:	23/05/2023
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe"
Imagebase:	0x690000
File size:	2842624 bytes
MD5 hash:	E7BF9F0C2C1977DDD8E139C13C27BE0D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	10
Start time:	16:30:55
Start date:	23/05/2023
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Vsob3IooE7.exe"
Imagebase:	0x4c0000
File size:	2842624 bytes
MD5 hash:	E7BF9F0C2C1977DDD8E139C13C27BE0D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	114
Total number of Limit Nodes:	7

Executed Functions

Function 02EC8668 Relevance: 1.6, Strings: 1, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Y(O`, xrefs: 02EC8A0B

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: Y(O`
API String ID: 0-2605497086
Opcode ID: e1a605fff79355854da5e3d38921aab2fe36246e12281b945bf7362d087e4ca3
Instruction ID: 5537c75839d5bb4dbffa14a10c0bcc3280e9935d4ae2e96d9fe76b9876393157
Opcode Fuzzy Hash: e1a605fff79355854da5e3d38921aab2fe36246e12281b945bf7362d087e4ca3
Instruction Fuzzy Hash: 9DD19175E4521A9FCB05DFE9C6915EEBBF2BF88310F20D42AD416B7344EB3499028B91

Uniqueness

Uniqueness Score: -1.00%

Function 015794A8 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c6b30a1f7a96c6a534c167b313ab2b3341a81d836be6fac7f5978be541566d
Instruction ID: 690c0101fad888fe996b02bb874306ebadeeb9ee6ef6b7b976369ce811a21a41
Opcode Fuzzy Hash: 02c6b30a1f7a96c6a534c167b313ab2b3341a81d836be6fac7f5978be541566d
Instruction Fuzzy Hash: 6B52AE31A0061ACFDB15CF58C885AAEB7B2FF45318F4588A9D909AF251D770FD85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02EC6DA1 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e6e5af872ac059f9ce0a00e02750c53b6e8d2294649138bd84ead676dae00e
Instruction ID: 4bfcf199cf10846e6e84ec8b402313a95541cad670eb65e6d8fe1ec80ea78c81
Opcode Fuzzy Hash: 95e6e5af872ac059f9ce0a00e02750c53b6e8d2294649138bd84ead676dae00e
Instruction Fuzzy Hash: 3FE16D70916204DFC704DFA9D68599DBFF6FB88310B24D46AD50AAB760DB389D42CF21

Uniqueness

Uniqueness Score: -1.00%

Function 02EC6DB0 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8353c6f25417343a18cfee1f7a691e74919b63187eec80d11503a822b59712
Instruction ID: 896eb4b895bbb5f8b6141e0a0f58f4f5a2e71bacca42fe4ac12369342d28a20d
Opcode Fuzzy Hash: 7c8353c6f25417343a18cfee1f7a691e74919b63187eec80d11503a822b59712
Instruction Fuzzy Hash: C8E16E70916204DFC704DFA9D68599DBFF6FB88310B24D06AD51AAB760DB389D42CF21

Uniqueness

Uniqueness Score: -1.00%

Function 02EC81D0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95801aecad5ded544de8286481929f5ced9de81e074db82bfd4574d3889f5ab7
Instruction ID: 13133ce43fe43017880fd276189c65a070370a2b6cd509685176ddba9a63df18
Opcode Fuzzy Hash: 95801aecad5ded544de8286481929f5ced9de81e074db82bfd4574d3889f5ab7
Instruction Fuzzy Hash: DAA11774E056598BCB08CFE9C6446AEFBF2BF88310F24D169D419BB358E7349942CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02EC81C0 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbe3519c1ef42cea22c35e34aed1030e2c3128fc4fe664cb427d87a82e5b092
Instruction ID: 21bdedc54d1c18b59e37d96e056c264ef5112f471000ee56126ed7c29b0483f7
Opcode Fuzzy Hash: dfbe3519c1ef42cea22c35e34aed1030e2c3128fc4fe664cb427d87a82e5b092
Instruction Fuzzy Hash: B3A11774E056598BCB09CFE9C6446AEFBF2BF88310F24D16AD419BB358D7349942CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02EC0006 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3322338bcd93d0c985d93f9802cfdb205a266cb6d4b861b7bcd58c08e8c60b7b
Instruction ID: 0f0f147869b358c05a74e13f215f62a16defbbf82f421f2e038615df808d340c
Opcode Fuzzy Hash: 3322338bcd93d0c985d93f9802cfdb205a266cb6d4b861b7bcd58c08e8c60b7b
Instruction Fuzzy Hash: 67312D71D056888FDB19CFAACC543DEFFF2AFCA310F18C0AAD444AA265DA341946CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02EC0040 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b95e97a2493bd86f34c631dac7fddaf5fcff0503c515829cfbc3c05b9f5ac40
Instruction ID: 34849fc35dd64804da3014a8744f66d067b69588f346324704f477ca4266d370
Opcode Fuzzy Hash: 8b95e97a2493bd86f34c631dac7fddaf5fcff0503c515829cfbc3c05b9f5ac40
Instruction Fuzzy Hash: 4A31C371E006188BEB18CFABD9446DEFBF7AFC8310F14C16AD509A6258DB741A46CA90

Uniqueness

Uniqueness Score: -1.00%

Function 02ECEC18 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c96c8948ab45e801fa57ce43504e696180d6e37a27024bcade09e5537ca6600
Instruction ID: 09dda94e71c185ae87649ae148317c5f7835c5b165ca48e332eced238ce47555
Opcode Fuzzy Hash: 9c96c8948ab45e801fa57ce43504e696180d6e37a27024bcade09e5537ca6600
Instruction Fuzzy Hash: 00112730D45298CFDB158FA5C919BEEBBF1AB4E305F28A06AD411B7280C7788945CB69

Uniqueness

Uniqueness Score: -1.00%

Function 01576A40 Relevance: 6.1, APIs: 4, Instructions: 124
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01576AB0
GetCurrentThread.KERNEL32 ref: 01576AED
GetCurrentProcess.KERNEL32 ref: 01576B2A
GetCurrentThreadId.KERNEL32 ref: 01576B83

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bad489ec7fe2b62dbed49e4e1f5994e2fb9a6ec3366bdfaf0ecb9e6a8b7cae82
Instruction ID: 483264db2a8d8eae039cb00045d581bd43368077bdefced693c0ccff31b6d3c8
Opcode Fuzzy Hash: bad489ec7fe2b62dbed49e4e1f5994e2fb9a6ec3366bdfaf0ecb9e6a8b7cae82
Instruction Fuzzy Hash: 115137B0901649CFDB15CFAAD588BDEBFF0FF88304F24846AD019AB250D7749884CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01576A50 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01576AB0
GetCurrentThread.KERNEL32 ref: 01576AED
GetCurrentProcess.KERNEL32 ref: 01576B2A
GetCurrentThreadId.KERNEL32 ref: 01576B83

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 47eb0b4d30a5f486319c4eb06b82a544439807d4a138d447d616def1c74f6a93
Instruction ID: ca40f643d3880e7220be910bd18d948635b386b7e66da3ae3bffa292c5a2405e
Opcode Fuzzy Hash: 47eb0b4d30a5f486319c4eb06b82a544439807d4a138d447d616def1c74f6a93
Instruction Fuzzy Hash: C75136B09016498FEB14DFAAD548BDEBFF0FF88314F208469E019BB250D7749884CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0157BA50 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0157BCA6

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5d29dd363d6888d532ebb08d8f6d03f679030cfbfa257072eb22dc4ec0c1cf72
Instruction ID: 959fa138c08ce02bb12b6017de00189c8b0b2a6c76d19de50441c487979ed6ed
Opcode Fuzzy Hash: 5d29dd363d6888d532ebb08d8f6d03f679030cfbfa257072eb22dc4ec0c1cf72
Instruction Fuzzy Hash: 027126B0A00B068FD724DF2AD55176ABBF1FF88200F10892ED48ADBA50DB75E805CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02ECD1D8 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 02ECD32B

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 51e2a269421f3f53bc564e1d54bff5f8ee98e65286baa621856ab5bb8615651f
Instruction ID: ea4eb0d09959ada1f84a2be0bc9fde81d0e5189e12198aba11b9560bf89d5323
Opcode Fuzzy Hash: 51e2a269421f3f53bc564e1d54bff5f8ee98e65286baa621856ab5bb8615651f
Instruction Fuzzy Hash: 8A5116719013199FDB60DF99C980BDEBBB5BF48304F1480AAE809B7250CB759A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157DF18 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0157E02A

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: fc522189000e67eff83ff8d13d8f32ae71abb76542dec6cc62a339f497ac53e2
Instruction ID: c97b0c0b3d9b8a0357f01a1a140a48128f9bdedd9931cf82d06f7b8cb619cbdd
Opcode Fuzzy Hash: fc522189000e67eff83ff8d13d8f32ae71abb76542dec6cc62a339f497ac53e2
Instruction Fuzzy Hash: C041BEB1D00309DFDB14CFAAD885ADEBBB5FF48310F24852AE419AB210D774A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0157DF0D Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0157E02A

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7f301d6278052c91ff8cf31d5447852ec5fb74e4458eead14a3f467afb0978da
Instruction ID: 4502d05e34101ea6f35a98db563292b1898352c7d3634ebcd44d7033aec8094f
Opcode Fuzzy Hash: 7f301d6278052c91ff8cf31d5447852ec5fb74e4458eead14a3f467afb0978da
Instruction Fuzzy Hash: E241DFB1D00309DFDB15CFA9D985ADEBBB5FF48310F24852AE819AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01577009 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01577107

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ad4fc553a1346f104169da95aaff1ed691e03e5ba8bba68ae6d9deef60753392
Instruction ID: 2a564b958b83f2c33cb574a46d1b9ece862246955e7f1616abbdcfb9709fa5c0
Opcode Fuzzy Hash: ad4fc553a1346f104169da95aaff1ed691e03e5ba8bba68ae6d9deef60753392
Instruction Fuzzy Hash: 264149B6900259AFCB01CFA9E844AEEBFF5FF88310F14805AE954A7311C3759914DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01577078 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01577107

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c968ac03b0457642beb4f0dcc2863d0932577f9b7b459383f7a174d670acfbf0
Instruction ID: d24d96dda67b4f28f355acde51dc505cfafc83de00b23c009760b45500a6289c
Opcode Fuzzy Hash: c968ac03b0457642beb4f0dcc2863d0932577f9b7b459383f7a174d670acfbf0
Instruction Fuzzy Hash: A521E5B5900209AFDB10CFAAE984ADEBFF4FF48310F24841AE954A7310D374A954DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02ECD898 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02ECD925

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 916fd783a4d81d73351dfbbe76ea98d58c8a90395f92e49abb417b27395acd6d
Instruction ID: c87b28be0e09736d1b51fa72552af8c95fe7763b87f8a9ce700e40adf7abed55
Opcode Fuzzy Hash: 916fd783a4d81d73351dfbbe76ea98d58c8a90395f92e49abb417b27395acd6d
Instruction Fuzzy Hash: FE21E2B59003499FCB10CFAAD985BDEBBF4FB48314F10842AE959A7250D778A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0157A980 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0157BD21,00000800,00000000,00000000), ref: 0157BF32

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 45674d811e5fea1b1864b7c29f16150c7e9272017792c5e08a33494209e72a87
Instruction ID: e7a2527ea9425b21dce9d4b03ca645af6ba2dd0ae88c25cef270049505972590
Opcode Fuzzy Hash: 45674d811e5fea1b1864b7c29f16150c7e9272017792c5e08a33494209e72a87
Instruction Fuzzy Hash: 40216AB28043498FCB10CFAAD844ADEBFF4FF49710F14895AD955AB240C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01577080 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01577107

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1da7df45770180b38da5e98b3d6989b9772c983a66af89454902a54f08cbdf67
Instruction ID: 915d0299d77ea5449052640b29187bc86214c4c82109ff336ee050b47c7407f7
Opcode Fuzzy Hash: 1da7df45770180b38da5e98b3d6989b9772c983a66af89454902a54f08cbdf67
Instruction Fuzzy Hash: A421E4B59002099FDB10CFAAE984ADEBFF4FB48320F14841AE954A7310D374A944DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02ECD608 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02ECD687

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 12fc4f32e123d813ff48649cbe87858dabdaf209ff7884576b112f25235aa469
Instruction ID: 0e5d8b0f5e482a62a0df6c7b5b68b4ba607088bbc2bec67302c7909a418208df
Opcode Fuzzy Hash: 12fc4f32e123d813ff48649cbe87858dabdaf209ff7884576b112f25235aa469
Instruction Fuzzy Hash: 0221EFB19003499FCB10CF9AD984ADEBBF4FB48320F10842AE959A7250D379A944DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02ECD548 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 02ECD5BF

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 2358d15ad5a603b58c6bcde066dbc31b5ec807482ce9820e0e5af164fd127880
Instruction ID: e00a074b783d9ca91dae1979867df8822c69c75e15143836b88589b35c0a3b53
Opcode Fuzzy Hash: 2358d15ad5a603b58c6bcde066dbc31b5ec807482ce9820e0e5af164fd127880
Instruction Fuzzy Hash: FB21F2B1D1061A9FCB10CF9AC985BEEFBF4BB48724F14812AD418B7640D778A9458FA1

Uniqueness

Uniqueness Score: -1.00%

Function 02EC6CA8 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02EC6D1B

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ff020dd95dd3f81145db5d0fbec3e9381afccc11a6d791dd705f428c367c5339
Instruction ID: b4e924c183425107cebabca2a62024770e4d5b19afe8aef05d3ea1b4bb19f41c
Opcode Fuzzy Hash: ff020dd95dd3f81145db5d0fbec3e9381afccc11a6d791dd705f428c367c5339
Instruction Fuzzy Hash: 6621E7B1D002099FCB10DF9AC984BDEFBF4FB48320F108429E559A7250D778A545DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02EC6CA0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02EC6D1B

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 89f0bca5f64159ff295d21ff41adfc480c3ae8d3a0ea8d030f0e9eac4fbae573
Instruction ID: 6069d83e0aa4cf9c3881be98596e516237a174d5c5b33657193d4e352367c9df
Opcode Fuzzy Hash: 89f0bca5f64159ff295d21ff41adfc480c3ae8d3a0ea8d030f0e9eac4fbae573
Instruction Fuzzy Hash: D421D6B5D006099FCB10CF9AC984BDEBBF4FB48320F248429E559A7650D378A645DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157A998 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0157BD21,00000800,00000000,00000000), ref: 0157BF32

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e17f94d9c4586a1bbd9898dd294b5ec681bb612f5795e569833777e46aaf3228
Instruction ID: c210d05cb9369515404ef6c521b40782f9ce0decf957c4dc4b63f924bab6127d
Opcode Fuzzy Hash: e17f94d9c4586a1bbd9898dd294b5ec681bb612f5795e569833777e46aaf3228
Instruction Fuzzy Hash: D511E4B69002099FDB10CF9AD844ADEFBF4FB48710F14852AE525AB600C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0157BEC0 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0157BD21,00000800,00000000,00000000), ref: 0157BF32

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aaa167e0bd46043053e2c7e998c58aca3f522225a9f15a1c1ff16ed68003321f
Instruction ID: 9590e8055a32c42453b9d20768b70340a610793b3a3774f4a98fd25ff2d82f10
Opcode Fuzzy Hash: aaa167e0bd46043053e2c7e998c58aca3f522225a9f15a1c1ff16ed68003321f
Instruction Fuzzy Hash: 9D1114B29002099FDB10CFAAD844ADEFBF4FB48710F10852AE565AB200C775A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02ECD6D8 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02ECD743

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9e7a41392e21d4e5451cec2f6ae11de7f3eab91f4b2236d33c8af5458238bd25
Instruction ID: c6148dc148ab58cb8329af035a3154733954fbd0b9cee0e597614c35bee3b717
Opcode Fuzzy Hash: 9e7a41392e21d4e5451cec2f6ae11de7f3eab91f4b2236d33c8af5458238bd25
Instruction Fuzzy Hash: 5811F2B59002499FCB10CF9AC984BDEBFF4FB88324F208429E529A7210D775A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0157BC40 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0157BCA6

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 39af6968e42ee0fcbec2bbd09d496b9dde9322d884b1fdc977b49814c67514c5
Instruction ID: 8b018b8fe5d0d7acd3a4ec0053280ca0e27fa82e8d9c7809e92270f891e5f0f3
Opcode Fuzzy Hash: 39af6968e42ee0fcbec2bbd09d496b9dde9322d884b1fdc977b49814c67514c5
Instruction Fuzzy Hash: 7A11E3B5C002498FDB10CF9AD544ADEFBF8EF88324F14842AD559B7600D774A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02ECDD70 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02ECDDCD

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: dd7798ff1a3eeb6da3bc5580f3511540b58ca41b6c45436b640c2fa01f5be375
Instruction ID: 1b2586d748304406a109caf6ec51357237e1586d67adcc825907a1cf148e779d
Opcode Fuzzy Hash: dd7798ff1a3eeb6da3bc5580f3511540b58ca41b6c45436b640c2fa01f5be375
Instruction Fuzzy Hash: D41112B58003099FDB10CF9AC984BDEBFF8EB48324F20841AE555A7600C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157E159 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0157E1BD

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: d4046bbb8534e1f1218ec21f95b7f020c933a039d906d8379f26afdf31b42aad
Instruction ID: 1f9de487846de32408a7a7440c12a8ca5a236a0113815e095b22fd321bc0ec21
Opcode Fuzzy Hash: d4046bbb8534e1f1218ec21f95b7f020c933a039d906d8379f26afdf31b42aad
Instruction Fuzzy Hash: 3A1103B69003098FDB10CF99D585BDEBBF4EB48320F24845AD955B7700C378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0157E160 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0157E1BD

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f0aaf994fbd6fc12b2cca47fdf3d0e990216771918d72efaa089ed646f440890
Instruction ID: 49e4863928e8f4e0b1e3ca0a1c675dda624cb41ca0a7addc574a4465475691d0
Opcode Fuzzy Hash: f0aaf994fbd6fc12b2cca47fdf3d0e990216771918d72efaa089ed646f440890
Instruction Fuzzy Hash: 4B11D0B59003099FDB10CF9AD985BDEBBF8EB88320F20845AD955A7740C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02ECDA50 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02ECDAAF

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 005961d017b6502d74e433a9cabf05c6a303a61e39fd478b6e9820fd98ec0960
Instruction ID: 4ef797a41a16a07aedeb92462b7543f21cfc5e973c7169b74e9d8e24f3b3a8da
Opcode Fuzzy Hash: 005961d017b6502d74e433a9cabf05c6a303a61e39fd478b6e9820fd98ec0960
Instruction Fuzzy Hash: 6E1112B18002098FCB10CF9AC984BDEBBF4EB48324F20846AD519B7200C775A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014FD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.427031259.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6064e01e4a3e0647fb6e303a0585748b0114a863c8869f81825733ffa734d66f
Instruction ID: 77bd584f468a4b07f3e718fc65dc002bd00eec19318a6506f2d63a0b8266f11f
Opcode Fuzzy Hash: 6064e01e4a3e0647fb6e303a0585748b0114a863c8869f81825733ffa734d66f
Instruction Fuzzy Hash: B8210A71904244DFDB05DF98D9C4B17BF65FB88328F24856EDA050B326C336D856D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0150D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.427484467.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627523067bb74502a7a7c4c0a6c03d8a12c997bf8e4b0461ee9752e12d08869d
Instruction ID: c7f38e4367ab1ec7432f69866f0235a52bab535c73763023f1c70da45c9c78f3
Opcode Fuzzy Hash: 627523067bb74502a7a7c4c0a6c03d8a12c997bf8e4b0461ee9752e12d08869d
Instruction Fuzzy Hash: 4E21F571504241EFDB06DFD8D5C0B2ABBB5FB84324F24CA6DE8494F286C736D846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0150D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.427484467.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3646806f36dee003475a0a4371570d64e7c0b23b3f139844a27c6d0d1303d1
Instruction ID: 7685149c601b1ac0aae65557644085833dca098229ef4ad94ba9a245e5cdb14d
Opcode Fuzzy Hash: 2f3646806f36dee003475a0a4371570d64e7c0b23b3f139844a27c6d0d1303d1
Instruction Fuzzy Hash: E221F1756042409FDB16CFD8D8D0B16BBA5FB84364F20C969D84A4F286D336D846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0150D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.427484467.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1297555f1a0a4b7627031d3da55caddfc4218f1b316ea121ea417802b375c1f
Instruction ID: 0cb004227c35d7d86c37449c06df7a16c7d73d8614677f1e8da499147ece0963
Opcode Fuzzy Hash: e1297555f1a0a4b7627031d3da55caddfc4218f1b316ea121ea417802b375c1f
Instruction Fuzzy Hash: 5E2180755093808FDB03CFA4D990B15BF71FB46214F28C5EAD8498F697C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 014FD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.427031259.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction ID: 866cc4290cb14b585d0ea6f5137cb499ec74e514fc7a5f5e847e09b09982cb71
Opcode Fuzzy Hash: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction Fuzzy Hash: 2811D376904280CFDB16CF54D5C4B16BF71FB84324F2486AED9050B72AC33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0150D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.427484467.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f825cc49a36603e58b05d30dbcded4ff69a659c0c942629433790640a090c2f4
Instruction ID: b08e2730257bbb40d96ed3b63e82de44089d2614a25e4e5c9cbb5b3cb7a19aa5
Opcode Fuzzy Hash: f825cc49a36603e58b05d30dbcded4ff69a659c0c942629433790640a090c2f4
Instruction Fuzzy Hash: 4C11BB75904280DFDB02CF98C6C0B19BBB1FB84324F28C6ADD8494F696C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 014FD75D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.427031259.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208bc6342dafbef95b700611c890d227d8e7bcbacfab2f87328dff6e61edfd18
Instruction ID: eb82503b48fa18044dbd1887f3b7e34d1a08112124f86f52b78c7a533a4b8f2c
Opcode Fuzzy Hash: 208bc6342dafbef95b700611c890d227d8e7bcbacfab2f87328dff6e61edfd18
Instruction Fuzzy Hash: C401F2319083C0AEE7108E99CC84B67BFD8EF41620F18841FEE455F366C3789844C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 014FD75C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.427031259.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c29d6096b8ed137b542024f832bab0826f236b76402db6968c2e62070501813
Instruction ID: 652f452f493b4104e3b9f9838621fa988139502a735519f8297b83ee931abed4
Opcode Fuzzy Hash: 0c29d6096b8ed137b542024f832bab0826f236b76402db6968c2e62070501813
Instruction Fuzzy Hash: 09F04F719042849EE7118A59CC84B63FFE8EF81624F18855EEE485F396C3789844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02EC1D50 Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

r6l, xrefs: 02EC1E79
)]"], xrefs: 02EC1F3F
)]"], xrefs: 02EC1F38

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: )]"]$)]"]$r6l
API String ID: 0-3320770255
Opcode ID: e285c187b640522f1e76b75eefd20a9c50ab57d5a7b661a3b4b16c394cae9fb6
Instruction ID: 187d386ff4249701dec1515d755f1d99d0139d5ed1702744c0751a2716c396eb
Opcode Fuzzy Hash: e285c187b640522f1e76b75eefd20a9c50ab57d5a7b661a3b4b16c394cae9fb6
Instruction Fuzzy Hash: 7A811174A14219DFCB04CFA9C6849AEFBF2FF89310F24946AD419AB355D330AA42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02EC1D41 Relevance: 3.9, Strings: 3, Instructions: 188COMMON

Download Yara Rule

Strings

r6l, xrefs: 02EC1E79
)]"], xrefs: 02EC1F3F
)]"], xrefs: 02EC1F38

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: )]"]$)]"]$r6l
API String ID: 0-3320770255
Opcode ID: b1c202501435cb844aee421f03a0e847b5c7e2702bf05bcd132f37d7084a076f
Instruction ID: a619b3ba6437f2655351a602cc54e50172d4c435725d16acb9edd574a59014e4
Opcode Fuzzy Hash: b1c202501435cb844aee421f03a0e847b5c7e2702bf05bcd132f37d7084a076f
Instruction Fuzzy Hash: D9810474A15209DFCB04CFA9C6849AEFBF2FF89310F24956AD419AB351D730AA42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02EC3188 Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

KY,, xrefs: 02EC326C
KY,, xrefs: 02EC3265

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: KY,$KY,
API String ID: 0-1625539038
Opcode ID: b5ee3d91f0a7f0e0c839a5c1088c6bb884e14eeeb1cddbb9af4cf6c1813dc8e0
Instruction ID: 44bfe8feb2a8d7b4e57c5a75140abbfbd7661475ba94d093e8b0dc9d1878c3cd
Opcode Fuzzy Hash: b5ee3d91f0a7f0e0c839a5c1088c6bb884e14eeeb1cddbb9af4cf6c1813dc8e0
Instruction Fuzzy Hash: 0661E574E55219CFCB08CFAACA815DEFBF2BB89210F24E56AD415B7314D7309A42CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02EC28C8 Relevance: 2.7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

dn8%, xrefs: 02EC2AB6
dn8%, xrefs: 02EC2AAF

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: dn8%$dn8%
API String ID: 0-1893559865
Opcode ID: 469650c6daf126de9f7e690cc39e28eaba3d6a7840e92ffbab8e21fbc4d42dc2
Instruction ID: 7b4ff8ace474c0856f7da2a63ec73dce72dfade5496411d94e32e231f4efd884
Opcode Fuzzy Hash: 469650c6daf126de9f7e690cc39e28eaba3d6a7840e92ffbab8e21fbc4d42dc2
Instruction Fuzzy Hash: 2771DF74D4021ACFCB08CF99D6809EEFBB1BF48350F24E55AD915AB214D334AA42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02EC8BA8 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

+1, xrefs: 02EC9043

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: +1
API String ID: 0-2008424990
Opcode ID: d759b7beb19ebd71583bda52ffe1797e00d9e330e69b37ac91bfa7b0d3399ac7
Instruction ID: 5e8f183dde49bfbf0abb523897ea9d56d63ab09a8f3993d67e40ab76e6a39819
Opcode Fuzzy Hash: d759b7beb19ebd71583bda52ffe1797e00d9e330e69b37ac91bfa7b0d3399ac7
Instruction Fuzzy Hash: B0912B74E112198FDB14CFA9CA80AADFBB2FF89300F24D1AAD509A7355D7309982CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02EC8B98 Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

+1, xrefs: 02EC9043

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: +1
API String ID: 0-2008424990
Opcode ID: feaf5e8f002c838c1ef521b703ab5536014afd6f3a2e654867a8c9a76f3b5b62
Instruction ID: 8a1e3a25f3908a101c809e99a66da34a075e231d197278300e9149dfc84034ce
Opcode Fuzzy Hash: feaf5e8f002c838c1ef521b703ab5536014afd6f3a2e654867a8c9a76f3b5b62
Instruction Fuzzy Hash: F2912A74E152198FDB14CFA9CA80BADFBB2BF89300F24D1AAD509A7355D7309982CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02ECB628 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

*Be, xrefs: 02ECB672

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: *Be
API String ID: 0-1292722480
Opcode ID: 248c0dc19bf29d5ad7811931c164144e88fc0592118651f8bba6ec59d5482714
Instruction ID: 424f7ad52f6fd04661f02811d0bb8be76c28d5a1934cf9f3aac9d2a9918be143
Opcode Fuzzy Hash: 248c0dc19bf29d5ad7811931c164144e88fc0592118651f8bba6ec59d5482714
Instruction Fuzzy Hash: 5461E274E59209CBCB08DFE9D5555EEFBB2EB89300F20A42ED406B7254DB349A42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02EC3178 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

KY,, xrefs: 02EC326C

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: KY,
API String ID: 0-3270746851
Opcode ID: 865d03c4d54351aebb5d934abe8186594da72975ac0476a066f59ca5415cece3
Instruction ID: c05fd301ca944209fa4025a0edc7ab955341f62d6cdb0eda952ece2ec8badd62
Opcode Fuzzy Hash: 865d03c4d54351aebb5d934abe8186594da72975ac0476a066f59ca5415cece3
Instruction Fuzzy Hash: 3861E274E552198FCB08CFA9CA815DEFBF2BF89210F24E5AAD405B7314D7309A42CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02EC2BC8 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

NvQ, xrefs: 02EC2DC0

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: NvQ
API String ID: 0-3763128010
Opcode ID: cf715b342f79f05010d49e3e888787d6c4b3644f8a33c7e3421176080eaa1c63
Instruction ID: dca250726342bfd954e53060fa63e067c2bafecac1b18ed56cfd52b3162a42f9
Opcode Fuzzy Hash: cf715b342f79f05010d49e3e888787d6c4b3644f8a33c7e3421176080eaa1c63
Instruction Fuzzy Hash: C96109B0D44609DFDB04CFE5C9819EEFBB2BB48300F24E46AD515A7214D734AA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02EC2BB9 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

NvQ, xrefs: 02EC2DC0

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: NvQ
API String ID: 0-3763128010
Opcode ID: 5d6fabcb8250864e4194689214e5c2068b68dd50d8c0d94f7f6f23ee80d133e3
Instruction ID: aa95a75fb1706fad35a7f24fc5d4edeee472bedaaedd3b0efc4b26b661de0a21
Opcode Fuzzy Hash: 5d6fabcb8250864e4194689214e5c2068b68dd50d8c0d94f7f6f23ee80d133e3
Instruction Fuzzy Hash: 7D61F9B4D4460A9FDB04CFE5CA419EEFBB2BF49300F24E46AD515A7250D7349A82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02ECBB78 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

PSGH, xrefs: 02ECBD2B

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: PSGH
API String ID: 0-1133269047
Opcode ID: 662a224d47239c1f8bde0d93d3e1d1b33911118f8d7ddbbae467eb9b6ace4e32
Instruction ID: 90a8dd1f72421aea28e89db2fd5c28ff2e18c58ec66a44634c77b8699cf7a180
Opcode Fuzzy Hash: 662a224d47239c1f8bde0d93d3e1d1b33911118f8d7ddbbae467eb9b6ace4e32
Instruction Fuzzy Hash: 4C611B71E5562A8BDB28CF66C9447E9BBF2AF89300F14D1FAD40DA7214EB305A81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02EC4110 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

U`dh, xrefs: 02EC42A5

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: U`dh
API String ID: 0-3619204197
Opcode ID: e70a2d8bdaa28d572cbdc401707bbd5a1a77a39f334a806b7a86e7aaa1e10ed2
Instruction ID: 0320d73a27f2583c764da21d0e09953b358e93006df0dda1d570261b40db0adc
Opcode Fuzzy Hash: e70a2d8bdaa28d572cbdc401707bbd5a1a77a39f334a806b7a86e7aaa1e10ed2
Instruction Fuzzy Hash: E1513971E156188BEB58CF6B8D4569EFAF7BFC8300F14C1BA950DA6264DB300A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 02EC410A Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

U`dh, xrefs: 02EC42A5

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID: U`dh
API String ID: 0-3619204197
Opcode ID: f635f00d048f251b9af23b40e8c703a7deb722fa09b599d04c24786a575935cb
Instruction ID: 22f640cfa770b209ad904745d11a3290d41f1cc12c117b9edb3a7c127d67775e
Opcode Fuzzy Hash: f635f00d048f251b9af23b40e8c703a7deb722fa09b599d04c24786a575935cb
Instruction Fuzzy Hash: A6511971E116188BEB58CF6BC94579EFAF3BFC8200F14C1BA950DAA254DB300A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 0157C148 Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e49c2142329b25d4f2ff25f9493da32dfd8bd5cafdaaadc8f39e353e852738
Instruction ID: 2952fc67270f6c97388b55d2117b2d33176556a1a383a76d1ac97227d29465bd
Opcode Fuzzy Hash: f9e49c2142329b25d4f2ff25f9493da32dfd8bd5cafdaaadc8f39e353e852738
Instruction Fuzzy Hash: 1C5258B1D4070A8FE710CF68E8C8599BBB1FB41398BD04A28C9616F6D1D3B4656ECF44

Uniqueness

Uniqueness Score: -1.00%

Function 0157A758 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.428038306.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8158cf20b2cb51718754641ce76382cbdfd444dc61132e9b05fc569eb0960b
Instruction ID: db8b55160ae89a1b27f57b8d6b7514f8c57d5368d7d66377e62c1dbf065727b8
Opcode Fuzzy Hash: ef8158cf20b2cb51718754641ce76382cbdfd444dc61132e9b05fc569eb0960b
Instruction Fuzzy Hash: 1FA14C32E1021A8FCF05DFB5D84459EBBB2FF85304B19856AE905BF221EB35A955CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02EC28B9 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9468356c1a8983919e62a1a820d2ff90d7653ef296ea510a3823495f9ca924e3
Instruction ID: 1a740c496d58d8936f9b4106b2bfb8190f951047ed9e498329b0394d341f6dfe
Opcode Fuzzy Hash: 9468356c1a8983919e62a1a820d2ff90d7653ef296ea510a3823495f9ca924e3
Instruction Fuzzy Hash: 4F61D474E4520ACFCB08CFA9C5809EEFBB1BF48350F24E55AD915A7215D334AA42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02ECA4E8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1d6ab6093adf4906e8cde9e3e8ffbbd914f9853421a64976a9d0ea827a7464
Instruction ID: dc1115b665b1576e55e5a05b04b4aa1cc3f110b2065c33b6ea9f3aa9768d473e
Opcode Fuzzy Hash: 6b1d6ab6093adf4906e8cde9e3e8ffbbd914f9853421a64976a9d0ea827a7464
Instruction Fuzzy Hash: 2F510874E146199FDB14CFA9D980B9EBBB2BF89310F20D0A9E509A7354DB309E41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02ECA4D8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1869a429495a5b97d9fe41d612c12fc5433dd8c565ec1b2fbce3f40fa524e08
Instruction ID: 031492071002250f4ca5da2d6df2b8b0fc63e0c13955468ba8e48556de51b586
Opcode Fuzzy Hash: a1869a429495a5b97d9fe41d612c12fc5433dd8c565ec1b2fbce3f40fa524e08
Instruction Fuzzy Hash: 6D512974E146199FDB14CFA9D981B9EBBB2BF89300F20D0A9D509AB364DB309E41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02EC33E8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9064d0943793d9a190129b5144d2b1d6f07f83ee973cbbf11e343ad332705dc2
Instruction ID: 77955b61fe2773b563d4745f725e213cbd423b3278af015db781640459cc5aa0
Opcode Fuzzy Hash: 9064d0943793d9a190129b5144d2b1d6f07f83ee973cbbf11e343ad332705dc2
Instruction Fuzzy Hash: 0E51F6B0E4564A9FCB44CFEAC6815EEFBB2FB88300F64D569C415B7214D7349A42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02EC33DA Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d2b414baa5887aae4f0ba9c262db8440eb39f0ac9a1b0ea7377518bbd5b3815
Instruction ID: cd2fffd9b3b846d46b92b679acc2898ce91d753cfd9a117dc66cbf1de1044475
Opcode Fuzzy Hash: 6d2b414baa5887aae4f0ba9c262db8440eb39f0ac9a1b0ea7377518bbd5b3815
Instruction Fuzzy Hash: D4510870E4564A9FCB44CFE9C6815EEFFB2FB89300F64D5AAC415A7254D3349A42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02EC2F41 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55b5fa142c8a411fc81ece81d712ff76fb8776296fef20a599edafb54fd0b1f
Instruction ID: b569491a6c5dabdc7654bc0c260611c0d43f54f3c3b8a148a344776199d5443d
Opcode Fuzzy Hash: f55b5fa142c8a411fc81ece81d712ff76fb8776296fef20a599edafb54fd0b1f
Instruction Fuzzy Hash: 9D4116B0E0460A9FDB04CFEAC5405EEFBF2BF89310F24D56AD515A7254D3349A428F94

Uniqueness

Uniqueness Score: -1.00%

Function 02EC2F50 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ebfce45918326d54b26b7ead496f640e08d2407b499b39edeff97ad4d89a76
Instruction ID: 4cd40bc77ab14718ba9e697520182181864f9fe92d75aa53613462a3297d789a
Opcode Fuzzy Hash: 78ebfce45918326d54b26b7ead496f640e08d2407b499b39edeff97ad4d89a76
Instruction Fuzzy Hash: 6F410770E0460A9FDB04CFEAC5815EEFBF2BB88310F24E46AD515B7258D3349A428F94

Uniqueness

Uniqueness Score: -1.00%

Function 02EC35F0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ffe73535f5b7653c236741df4405fddda3753440eea38c1ad4c8686a55a511
Instruction ID: 0eda9f626a613eac4d61773c65056439f99be5f27c47cebb60044b5ca681426e
Opcode Fuzzy Hash: 78ffe73535f5b7653c236741df4405fddda3753440eea38c1ad4c8686a55a511
Instruction Fuzzy Hash: 18411DB1E456198FDB18CFAAC95079EBBF3ABC9300F14C1BAC418AB255DB305946CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02EC3600 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.429134472.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7bb211de6b83939252c073741ba7ffa987ef34fb0ff2e89542127b5ab133b6
Instruction ID: bbaf059c539decc3849c15f53d5323c2bba91a2086f3f1911d177b4096c15253
Opcode Fuzzy Hash: 0d7bb211de6b83939252c073741ba7ffa987ef34fb0ff2e89542127b5ab133b6
Instruction Fuzzy Hash: 9731B671E416189BEB18CFABD84079EFBF3BBC8300F14C1BAD908A6254DB345A468F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Vsob3IooE7.exePID: 2068, Parent PID: 3324COMMON

Executed Functions

Function 02B63768 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.484833989.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4168cd8672bc5ab22065d9837a58f72c8d93644ab7e1b914a50e3cede4522a5
Instruction ID: dd0ddc39c5b27afd0620d08a03bf75846b4785f5fe593b94ef360c9c2bbeef85
Opcode Fuzzy Hash: f4168cd8672bc5ab22065d9837a58f72c8d93644ab7e1b914a50e3cede4522a5
Instruction Fuzzy Hash: 0861C474E0524A8FCB04EFA8D455AEE7BB2FF85300F1084AAD145AB7A5DB34AD05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02B63808 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.484833989.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f13aae1254e87c9105cde2e5d726e8ce97e3206ae8a79c4c16ad70b0fc6ec5a
Instruction ID: 24a2a3df870c38ba03d90e4226bc98f83f30c8396bcd376bf82b8fe7e6528684
Opcode Fuzzy Hash: 5f13aae1254e87c9105cde2e5d726e8ce97e3206ae8a79c4c16ad70b0fc6ec5a
Instruction Fuzzy Hash: 52518B70E0024ADFCB04EFA9D4959AEBBB2FF84300F108569D145AB361EB34AD05DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02B60438 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.484833989.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296d4428ec06b4c284558a1634cf8177859ae7f4df664e765b6782c935b55038
Instruction ID: ab4eab20cf9f9a8dec6f789b36029bf67b9c51bec16779906c4af8f3d8abef2e
Opcode Fuzzy Hash: 296d4428ec06b4c284558a1634cf8177859ae7f4df664e765b6782c935b55038
Instruction Fuzzy Hash: 97F09AB0D512148BEB299FA4D86D6BEBFB1FB49311F10182AD502B3690DBB84840CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02B60448 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.484833989.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_Vsob3IooE7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97eaf178a6e79d114812e69b3cf200f45cc2e890810836f9e459db5dc79b6c31
Instruction ID: 5ced10da75e89c5d41f5b65918e5dda1077c72ab311c866b2bf3021ad2e01b4d
Opcode Fuzzy Hash: 97eaf178a6e79d114812e69b3cf200f45cc2e890810836f9e459db5dc79b6c31
Instruction Fuzzy Hash: E5F0A730D41219CBDB289FA5D81C7BEBBB4FB09310F001829D105B3690CBB45944C794

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Vsob3IooE7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Sigma Signatures

Bitcoin Miner

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Vsob3IooE7.exe.log

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
Vsob3IooE7.exe

Function 02EC8668 Relevance: 1.6, Strings: 1, Instructions: 359
COMMON

Function 01576A40 Relevance: 6.1, APIs: 4, Instructions: 124
threadCOMMON

Function 01576A50 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 0157BA50 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Function 02ECD1D8 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Function 0157DF18 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 0157DF0D Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 01577009 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 01577078 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON