Edit tour

Windows Analysis Report
NfPIgjwteS.exe

Overview

General Information

Sample name:	NfPIgjwteS.exe renamed because original name is a hash value
Original sample name:	8d800c3c7c7eb2c03f22b365f52fbff0.exe
Analysis ID:	1527268
MD5:	8d800c3c7c7eb2c03f22b365f52fbff0
SHA1:	6e41a8832aac5fae24165ca5de98aaf14ed8aa97
SHA256:	4bf737f017a40c23e888891a415711dfa6cae8302f46922e97da60f43a0ae40c
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)

Detected potential crypto function

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

NfPIgjwteS.exe (PID: 6408 cmdline: "C:\Users\user\Desktop\NfPIgjwteS.exe" MD5: 8D800C3C7C7EB2C03F22B365F52FBFF0)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: NfPIgjwteS.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: G:\PROGRAMAS VISUAL STUDIO\pse-nuevo-vbs\pse-nuevo-vbs\obj\Debug\pse-nuevo-vbs.pdb4UNU @U_CorExeMainmscoree.dll source: NfPIgjwteS.exe
Source:	Binary string: G:\PROGRAMAS VISUAL STUDIO\pse-nuevo-vbs\pse-nuevo-vbs\obj\Debug\pse-nuevo-vbs.pdb source: NfPIgjwteS.exe

Source: NfPIgjwteS.exe, 00000000.00000002.3023431823.0000000002571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp, NfPIgjwteS.exe, 00000000.00000002.3024269367.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_0077C1B8	0_2_0077C1B8
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_0077DBD0	0_2_0077DBD0
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_04948B98	0_2_04948B98
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_04945F4C	0_2_04945F4C
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_06B91EC0	0_2_06B91EC0
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_06B97F40	0_2_06B97F40
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_06B92B50	0_2_06B92B50
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_06B97F40	0_2_06B97F40
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_06B92B40	0_2_06B92B40
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_06B91EC0	0_2_06B91EC0

Source: NfPIgjwteS.exe, 00000000.00000000.1770681266.00000000000A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepse-nuevo-vbs.exe< vs NfPIgjwteS.exe
Source: NfPIgjwteS.exe, 00000000.00000002.3023152059.000000000081E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs NfPIgjwteS.exe
Source: NfPIgjwteS.exe	Binary or memory string: OriginalFilenamepse-nuevo-vbs.exe< vs NfPIgjwteS.exe

Source: classification engine

Classification label: clean3.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\NfPIgjwteS.exe

Mutant created: NULL

Source: NfPIgjwteS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: NfPIgjwteS.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\NfPIgjwteS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Section loaded: textshaping.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\NfPIgjwteS.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: NfPIgjwteS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NfPIgjwteS.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: NfPIgjwteS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: G:\PROGRAMAS VISUAL STUDIO\pse-nuevo-vbs\pse-nuevo-vbs\obj\Debug\pse-nuevo-vbs.pdb4UNU @U_CorExeMainmscoree.dll source: NfPIgjwteS.exe
Source:	Binary string: G:\PROGRAMAS VISUAL STUDIO\pse-nuevo-vbs\pse-nuevo-vbs\obj\Debug\pse-nuevo-vbs.pdb source: NfPIgjwteS.exe

Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_007708D8 push C0330066h; ret		0_2_007708E2
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Code function: 0_2_04943D0B push dword ptr [ecx+ecx-75h]; iretd		0_2_04943D1B

Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Memory allocated: 700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Memory allocated: 2570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Memory allocated: 23C0000 memory reserve \| memory write watch	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\NfPIgjwteS.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Users\user\Desktop\NfPIgjwteS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NfPIgjwteS.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NfPIgjwteS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NfPIgjwteS.exe	11%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	NfPIgjwteS.exe, 00000000.00000002.3023431823.0000000002571000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	NfPIgjwteS.exe, 00000000.00000002.3024328990.00000000066B2000.00000004.00000800.00020000.00000000.sdmp, NfPIgjwteS.exe, 00000000.00000002.3024269367.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527268
Start date and time:	2024-10-06 22:11:40 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NfPIgjwteS.exe renamed because original name is a hash value
Original Sample Name:	8d800c3c7c7eb2c03f22b365f52fbff0.exe
Detection:	CLEAN
Classification:	clean3.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 28 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: NfPIgjwteS.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.337882193816427
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	NfPIgjwteS.exe
File size:	16'384 bytes
MD5:	8d800c3c7c7eb2c03f22b365f52fbff0
SHA1:	6e41a8832aac5fae24165ca5de98aaf14ed8aa97
SHA256:	4bf737f017a40c23e888891a415711dfa6cae8302f46922e97da60f43a0ae40c
SHA512:	f15cc14735c02896a5540e230712d89629b060286c3fec4b5f4e16c7fbe08caf844b12bd01467b7858f3060daf3814dacc8f3e5d20f2c879e7f8e2d34ba5289e
SSDEEP:	384:c5HdkVF+GJUBLgTN8PYnHGEMaGPlJkkUb7:c5Hdm+Ge1GhGla27kkO
TLSH:	F372294887E4C375C2BD6BB618636D0047F2EA65C523FF1E5DC8A89E1F236408792B72
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........."...P..6..........^U... ...`....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40555e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64831C8F [Fri Jun 9 12:35:27 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x550c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x5cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x53d4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3564	0x3600	b622e145fadd031e87aaf61407207502	False	0.474609375	data	5.606921445770961	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x5cc	0x600	4ab6a696514e85326f67043f2a9e1351	False	0.41796875	data	4.109810656149431	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8000	0xc	0x200	5f30fe1e90b2f253432b992a220e4c8d	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x33c	data			0.4166666666666667
RT_MANIFEST	0x63dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: NfPIgjwteS.exePID: 6408, Parent PID: 2580

General

Target ID:	0
Start time:	16:12:42
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\NfPIgjwteS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NfPIgjwteS.exe"
Imagebase:	0xa0000
File size:	16'384 bytes
MD5 hash:	8D800C3C7C7EB2C03F22B365F52FBFF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: NfPIgjwteS.exePID: 6408, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.7%
Total number of Nodes:	182
Total number of Limit Nodes:	22

Executed Functions

Function 06B92B50 Relevance: 1.9, Strings: 1, Instructions: 693
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fff?, xrefs: 06B931B7

Memory Dump Source

Source File: 00000000.00000002.3024725743.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: 2a23e0c1f9383fb67ca572a5ec505c1a7b6ccc5c1ccc045f91cd36d67ac3d16e
Instruction ID: 5abf3f5f64617386fe7680dda5058e3ca29aedb4cdfcbd5b1b95f6967070ebf0
Opcode Fuzzy Hash: 2a23e0c1f9383fb67ca572a5ec505c1a7b6ccc5c1ccc045f91cd36d67ac3d16e
Instruction Fuzzy Hash: 63623C3180061ADFCF11DF60C984AD9B7B2FF99304F1586D5E9086B225EB75AAD9CF80

Function 06B92B40 Relevance: 1.7, Strings: 1, Instructions: 453
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fff?, xrefs: 06B931B7

Memory Dump Source

Source File: 00000000.00000002.3024725743.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: 6e768dafec2ca83b8ec5e2db928b8bb90d9480d03dd0075bfd0590afa5e2164d
Instruction ID: ad6ef47a35d0954e8da0f9fdeb0550ac75369ced8fa949ee2a2d7bdec9960129
Opcode Fuzzy Hash: 6e768dafec2ca83b8ec5e2db928b8bb90d9480d03dd0075bfd0590afa5e2164d
Instruction Fuzzy Hash: 30125B7590061ADFCF11DF50C884AE9BBB2FF49304F0585E5D9086B266DB76AE89CF80

Function 06B91EC0 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3024725743.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ab35568a6700bad8292826461e071ab8d2d9d6d056e2652cf4470d459909e
Instruction ID: 734f18717223fd28ce57120fe54222b290d548fd9f6d4d2c17cb084bcbfa9343
Opcode Fuzzy Hash: 944ab35568a6700bad8292826461e071ab8d2d9d6d056e2652cf4470d459909e
Instruction Fuzzy Hash: 65526935A1061ADFCF61DF64C854AE9B7B1FF49300F1481E9E509AB261EB35EA81CF50

Function 06B97F40 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3024725743.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af02dd0be42cc98293838c62d97084b374b9ee55055728922554c11718f2c46f
Instruction ID: 9fd266fee39e367112123c2e86c068fd46457278ff76af3e836bf03affd46cd5
Opcode Fuzzy Hash: af02dd0be42cc98293838c62d97084b374b9ee55055728922554c11718f2c46f
Instruction Fuzzy Hash: D7323671A0061ACFDF61DF64C944BD9B7B2FF8A300F1485E9E509AB221DB75AA84CF50

Function 00777780 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0077780F

Strings

W, xrefs: 00777785

Memory Dump Source

Source File: 00000000.00000002.3022879101.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_NfPIgjwteS.jbxd

Similarity

API ID: DuplicateHandle
String ID: W
API String ID: 3793708945-655174618
Opcode ID: 7d7b08c9f0010dae9cca96cb8a43506b46074bae01ad939469f50857c63a6c2a
Instruction ID: 566496dbe38781acd5556061afe4e488f53c4420f7476c91227ae6fee9e71514
Opcode Fuzzy Hash: 7d7b08c9f0010dae9cca96cb8a43506b46074bae01ad939469f50857c63a6c2a
Instruction Fuzzy Hash: 5221F2B5D00249DFDB10CFAAD984ADEBBF4EF48320F24845AE958A7250D378A940CF61

Function 0077D4C8 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3022879101.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fedefcd5a0cc7952de25159ed65b7bacb041b6813ad1d6fbf89ef5f5cb27a3de
Instruction ID: ede37368d99e507651672ff3a071bcada18b03e4930f435d0285a350b7ab022f
Opcode Fuzzy Hash: fedefcd5a0cc7952de25159ed65b7bacb041b6813ad1d6fbf89ef5f5cb27a3de
Instruction Fuzzy Hash: 3F8156B0A00B058FDB24DF29D44475ABBF2FF88344F00892DE48ADBA50D779E959CB91

Function 0077C53C Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0077FBE2

Memory Dump Source

Source File: 00000000.00000002.3022879101.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_NfPIgjwteS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: eb121a418ae70937e2114de5f1b8ba685c315f2f6901505acdd4e21fd139f1d1
Instruction ID: 4f4f349b676592b84bc5078faee49d79f1ea7e4024f23ecb81229d057e869cd7
Opcode Fuzzy Hash: eb121a418ae70937e2114de5f1b8ba685c315f2f6901505acdd4e21fd139f1d1
Instruction Fuzzy Hash: BF51BCB1D003099FDF14CFAAC984ADEBBB5FF48350F24812AE819AB250D774A845CF90

Function 00777848 Relevance: 1.6, APIs: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0077780F

Memory Dump Source

Source File: 00000000.00000002.3022879101.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_NfPIgjwteS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6d8fd349d89aa4b7c71ee77d0cebe21aad8d71e44e9ec1ba587781fcd142c9aa
Instruction ID: f32c6eb81dacb81389fd77f628aa79c0530a0e9ae4dfe83fd23877e8fb0b7d80
Opcode Fuzzy Hash: 6d8fd349d89aa4b7c71ee77d0cebe21aad8d71e44e9ec1ba587781fcd142c9aa
Instruction Fuzzy Hash: 1F415EB4A40344DFEB05EF64E948ABA7BB5FB48301F208429EA058B7A4C7785D16DF71

Function 06B97668 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 06B97707

Memory Dump Source

Source File: 00000000.00000002.3024725743.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_NfPIgjwteS.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 583a2d154955e4d3d692999c50b88859204a4e58a3b385b99f9558cd957bbfdb
Instruction ID: 47ff00a4abb428c4adc8238418bea9818ffffac08cf165ba0de1e6eaefe95f13
Opcode Fuzzy Hash: 583a2d154955e4d3d692999c50b88859204a4e58a3b385b99f9558cd957bbfdb
Instruction Fuzzy Hash: B63104B5D102099FDF50CF99D880ADEFBF5FB48320F24846AE519A7210D774A541CFA0

Function 06B97670 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 06B97707

Memory Dump Source

Source File: 00000000.00000002.3024725743.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_NfPIgjwteS.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 4f8cd45e2421f76c4f06191a8db77781c98540b78e96d5187d50468cdb5b3a95
Instruction ID: fb236362660851d55c3ef8be22c5e3188c9c87e2c1ef56a3454b880011ced932
Opcode Fuzzy Hash: 4f8cd45e2421f76c4f06191a8db77781c98540b78e96d5187d50468cdb5b3a95
Instruction Fuzzy Hash: 8721AEB5D112499FDB10CF9AD884ADEFBF5FB48320F24842AE919A7210D775A944CFA0

Function 00777788 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0077780F

Memory Dump Source

Source File: 00000000.00000002.3022879101.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_NfPIgjwteS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5b3c4e8f5d78edd60dc3c5d0ca1038e4174ebb90754062d4922a9f6c46406f3f
Instruction ID: 6df12b76d3371d7b037f9936de12f4d21bc9506904b58db2d113267db5eb136e
Opcode Fuzzy Hash: 5b3c4e8f5d78edd60dc3c5d0ca1038e4174ebb90754062d4922a9f6c46406f3f
Instruction Fuzzy Hash: FD21E6B5D00208DFDB10CF9AD984ADEBBF4FB48320F14841AE918A3350D378A940CF61

Function 0077F730 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0077FD00,?,?,?,?), ref: 0077FD75

Memory Dump Source

Source File: 00000000.00000002.3022879101.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_NfPIgjwteS.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: b803fc491e2138d1495326175166c2f5fca183e04ed04b3c1418fb7d9b1ef297
Instruction ID: 335822ea7d05ed4bcc3f3a6c2b90196c8aba82a0ee5cc38df7c2c5d415e15b42
Opcode Fuzzy Hash: b803fc491e2138d1495326175166c2f5fca183e04ed04b3c1418fb7d9b1ef297
Instruction Fuzzy Hash: F42189B1900249CFCB20DF9AD985BDEBBF8EF48314F20842AD448A7341C374A944CFA5

Function 0077F6EC Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0077FD00,?,?,?,?), ref: 0077FD75

Memory Dump Source

Source File: 00000000.00000002.3022879101.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_NfPIgjwteS.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: b31d599da4094037b855e325728ba0cfb698fbf64fdc878207703d8824677b7f
Instruction ID: 6457b723058213343298099f22815573df1258bf83ce363a0a56bc2f2e56df96
Opcode Fuzzy Hash: b31d599da4094037b855e325728ba0cfb698fbf64fdc878207703d8824677b7f
Instruction Fuzzy Hash: 701128B5900349CFDB20CF99D544BDEBBF8EB48320F20841AD558A7300C374A944CFA1

Function 0077D6C8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0077D72E

Memory Dump Source

Source File: 00000000.00000002.3022879101.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_NfPIgjwteS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 707a087cafa26187e3c586c8241121e233a8fc827a8ad066b7263d24b9e3134a
Instruction ID: d422d78fe0c510d4bab9aea41fd4f29d13e93fe3236a5a9748c47d888533a572
Opcode Fuzzy Hash: 707a087cafa26187e3c586c8241121e233a8fc827a8ad066b7263d24b9e3134a
Instruction Fuzzy Hash: F211DFB5D006498FCB24CF9AD444ADEFBF5AF88324F24842AD459A7610C3B9A945CFA1

Function 06B9C308 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageA.USER32 ref: 06B9C365

Memory Dump Source

Source File: 00000000.00000002.3024725743.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_NfPIgjwteS.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: e1978c20b15c9a16a5cec26d30852b2f11dd28d183885a32671615cbd63d51a8
Instruction ID: 42be85f886b34432da6a7687a6d4af1fda2034221ec60ea10db4a65ddf0187c1
Opcode Fuzzy Hash: e1978c20b15c9a16a5cec26d30852b2f11dd28d183885a32671615cbd63d51a8
Instruction Fuzzy Hash: 071100B5C04649CFCB20CFAAD944BCEFBF4EB49324F20846AD418A3250C378A544CFA5

Function 06B9C301 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageA.USER32 ref: 06B9C365

Memory Dump Source

Source File: 00000000.00000002.3024725743.0000000006B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b90000_NfPIgjwteS.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: fc96257229a3d4a34d5921c7aa75f0b9ea7900b2c815e0a1418b1cf78491e8f7
Instruction ID: c84446f18e23bc131b48a4aa566f2b6455031bea47c4083cc76c9d6a7c0ca30b
Opcode Fuzzy Hash: fc96257229a3d4a34d5921c7aa75f0b9ea7900b2c815e0a1418b1cf78491e8f7
Instruction Fuzzy Hash: EE1122B5D04649CFCB20CF9AD544BCEFBF5EB48314F24846AD418A3250C338A500CFA5

Function 0065D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022419354.000000000065D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0065D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d755abc42f28b3a6c8145f1eef4f6ed8786c7cd0b254eb7c5df433787c3ec449
Instruction ID: 4b5a0566adce3de4bd799b6c6b186ff0d26ae9c802e60526e86b1da6e7faf07d
Opcode Fuzzy Hash: d755abc42f28b3a6c8145f1eef4f6ed8786c7cd0b254eb7c5df433787c3ec449
Instruction Fuzzy Hash: D82128B1504200EFDB25DF14D9C0B26BFA6FB94325F24C569ED090B396C336E85AD7A1

Function 0065D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022419354.000000000065D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0065D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ca73f077971c223b19bd97d672a5e54a211c7d266645b0e0462d3941552ec5
Instruction ID: 194c41fd7dbafea0feaa4e303ad346dc84feb766aba94d1292aae3a53ae44c4e
Opcode Fuzzy Hash: e2ca73f077971c223b19bd97d672a5e54a211c7d266645b0e0462d3941552ec5
Instruction Fuzzy Hash: FC2136B1504200DFCB25CF04C9C0B26BF66FB98319F208569ED090B396D336D84ACAA2

Function 0066D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022485908.000000000066D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0066D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb81811ad5260b3ef23b032afb0f219ae5dfc58707e49ada42c80ab91a241e33
Instruction ID: bc267334b74344bf659bf37507f32febb9ad1dd73cc0ac0899a19da4f9a108c9
Opcode Fuzzy Hash: cb81811ad5260b3ef23b032afb0f219ae5dfc58707e49ada42c80ab91a241e33
Instruction Fuzzy Hash: A92129B1A04240EFDB15DF14D5D0B26BB6AFB84314F24C56DEA094B355C336D946CB61

Function 0066D2D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022485908.000000000066D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0066D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f27009493783b362c5afc167e3507ad538fc5793266ec7b79ad9cbff649682
Instruction ID: 6c3e8826aa6abd959811350ffb0930176be609eea2caf36bddaf94bb6a851407
Opcode Fuzzy Hash: 78f27009493783b362c5afc167e3507ad538fc5793266ec7b79ad9cbff649682
Instruction Fuzzy Hash: 6A2126B1A04240EFDB04DF14D5C0B2ABB66FBC4324F24C669D9095B346C33AD806DAA2

Function 0066D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022485908.000000000066D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0066D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2845a5b4f611b2f14ba92405af2b2075a7e1c5af5ba05a840fb8327171c725
Instruction ID: 31b13277f5d6f7059df44e5fa887f5c753bca832b116524864fc95558cb5d7bb
Opcode Fuzzy Hash: 2c2845a5b4f611b2f14ba92405af2b2075a7e1c5af5ba05a840fb8327171c725
Instruction Fuzzy Hash: F321F2B5A04240DFCB14DF14D9C0B26BB66FB88314F24C96DE90A4B396C33BD847CAA1

Function 0065D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022419354.000000000065D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0065D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: b3507d6eeb7b23785d3e5ab714929a6a1fd42f59440ba97dfcc512b5e8caf807
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 7011DF72404240CFCB12CF00D5C0B56BFA2FB94324F24C5A9DC090B696C33AE85ACBA2

Function 0065D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022419354.000000000065D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0065D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: f7db738bc633ac71a0a726ab0665ee8584e03d79f454a4ac13fd392841de1759
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: EF11DF72404240CFCB16CF00D5C0B56BF72FB94318F2482A9DC090B296C33AD85ACBA1

Function 0066D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022485908.000000000066D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0066D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 51766627eebf27d0eda19811a6d6b1a435cc398c5f1f18e1d64ddfaa1320ef17
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 25118E75A04280DFDB15CF14D5C4B55BB62FB84314F24C6AAD8494B756C33AD84ACB61

Function 0066D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022485908.000000000066D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0066D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 65a376ec13e1545c0e708b8207ab9a891cda2585a69eb219fae88db6c8afc06f
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 2D11BB75A04280DFCB12CF10C5D0B15BBA2FB84314F28C6AAD9494B796C33AD84ACB61

Function 0066D2CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022485908.000000000066D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0066D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6571a979d86382cef3f3a0ee6dcd591210bcaba3c37dfea3d6794a8d99f67603
Instruction ID: 892d59cdcd697e6ddd922b482c21a37a2c53111e940b2319611bdb07e8d44c8b
Opcode Fuzzy Hash: 6571a979d86382cef3f3a0ee6dcd591210bcaba3c37dfea3d6794a8d99f67603
Instruction Fuzzy Hash: 2011E275A04280DFDB11CF10D5C0B59FB62FB84324F24C6AAD8495B746C33AD80ACBA2

Function 0065D6E7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022419354.000000000065D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0065D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac10dc347cd732ac61e64b7abce36ca890e5db5b189166c411ce8baaa0e104fb
Instruction ID: e7080ade4ad16d14fda86cde9a6a662a29293234e51dba0e353cdd336622ce8a
Opcode Fuzzy Hash: ac10dc347cd732ac61e64b7abce36ca890e5db5b189166c411ce8baaa0e104fb
Instruction Fuzzy Hash: 20F0FF75600604AF97208F0AD984C63FBADEBC5774715C55AEC494B752C671FC41CAA0

Function 0065D6D8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022419354.000000000065D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0065D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65d000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eca8a44701a133f1030c6ac2fc721fc1c784c86ce95c968e1f4e68010365497
Instruction ID: 4b0488fb9881e99f75904e212ac259e63935bd797a9c7243f0fda543f5c49992
Opcode Fuzzy Hash: 0eca8a44701a133f1030c6ac2fc721fc1c784c86ce95c968e1f4e68010365497
Instruction Fuzzy Hash: E5F03C75104680AFD3258F06C984C63BFB9EF8A7607198489E8854B352C631FC42CB60

Non-executed Functions

Function 0077DBD0 Relevance: 1.8, Strings: 1, Instructions: 521COMMON

Download Yara Rule

Strings

U, xrefs: 0077DE21

Memory Dump Source

Source File: 00000000.00000002.3022879101.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 41eeb4645a5153ff489f7598c7e94f83aa9b47d239e318c2b318d10f99754564
Instruction ID: ca6b5c72ab7d898838e15a326d07cfe2f855bb1496f4891815c4c7668e887aa6
Opcode Fuzzy Hash: 41eeb4645a5153ff489f7598c7e94f83aa9b47d239e318c2b318d10f99754564
Instruction Fuzzy Hash: 0952F5B0602F06CFD724CF28EC881A97BB1FB40354F91C219D6665B2B5D7B8694ACF58

Function 04948B98 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3023707851.0000000004940000.00000040.00000800.00020000.00000000.sdmp, Offset: 04940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4940000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9870705030b3ddd53f751b6c8e942a88158934f32a62f06f4c2bbeeda71ada9d
Instruction ID: b0f0e00b2e8842223b0572a17b1a2b41f0cb4b938523618e964755b97ba704ba
Opcode Fuzzy Hash: 9870705030b3ddd53f751b6c8e942a88158934f32a62f06f4c2bbeeda71ada9d
Instruction Fuzzy Hash: 2D42A338A50219CFD714EF64C898E9DB7B2FF8A304F5181A9E509AB361DB30AD85DF50

Function 04945F4C Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3023707851.0000000004940000.00000040.00000800.00020000.00000000.sdmp, Offset: 04940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4940000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0747233100f9a5965ceed38a9b6170719b2777a5446739413cdc499f76771373
Instruction ID: d6a63e65bfd95dade956ae247a8200e5fdf23db3787c98b9ee6e0aba21fda4c0
Opcode Fuzzy Hash: 0747233100f9a5965ceed38a9b6170719b2777a5446739413cdc499f76771373
Instruction Fuzzy Hash: D642A338A50219CFD714EF64C898E9DB7B2FF8A304F5181A9D509AB361DB30AD45DF50

Function 0077C1B8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3022879101.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_NfPIgjwteS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66c0ae93a3f373ffbb4fbab1dec51cadef1974b443bd9b0f672b7a1b7d942ae
Instruction ID: bb3c2af3f64ad93d2bc495919a48642fa6e6579bfa2e3556cf54b1a7af44cdf3
Opcode Fuzzy Hash: c66c0ae93a3f373ffbb4fbab1dec51cadef1974b443bd9b0f672b7a1b7d942ae
Instruction Fuzzy Hash: 4EA16432E00219CFCF16DFB4D84459EB7B2FF89340B15856EE909AB222DB75D955CB80

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NfPIgjwteS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: NfPIgjwteS.exePID: 6408, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: NfPIgjwteS.exePID: 6408, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 06B92B50 Relevance: 1.9, Strings: 1, Instructions: 693COMMON

Control-flow Graph

Function 06B92B40 Relevance: 1.7, Strings: 1, Instructions: 453COMMON

Windows Analysis Report
NfPIgjwteS.exe

Function 06B92B50 Relevance: 1.9, Strings: 1, Instructions: 693
COMMON

Function 06B92B40 Relevance: 1.7, Strings: 1, Instructions: 453
COMMON

Function 00777780 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Function 0077D4C8 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Function 0077C53C Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 00777848 Relevance: 1.6, APIs: 1, Instructions: 105
COMMON