Windows Analysis Report
CswRsjV3kH.exe

Overview

General Information

Sample name: CswRsjV3kH.exe
renamed because original name is a hash value
Original sample name: 3E6CD9723E292652064FC1A06D75CBE4.exe
Analysis ID: 1429015
MD5: 3e6cd9723e292652064fc1a06d75cbe4
SHA1: f1f8ab71fa3dd76b0491c4b5133fdeb2f9fae162
SHA256: 9172b16ccd9506d70f0ef99e07853e683f700a0b79f83dfa6a121abf97ec48cd
Tags: exeRedLineStealer
Infos:

Detection

RedLine
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
.NET source code contains very large array initializations
Hides threads from debuggers
Installs new ROOT certificates
Machine Learning detection for sample
PE file has nameless sections
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Detected potential crypto function
Drops certificate files (DER)
Enables debug privileges
Enables security privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: CswRsjV3kH.exe ReversingLabs: Detection: 50%
Source: CswRsjV3kH.exe Virustotal: Detection: 36% Perma Link
Machine Learning detection for sample
Source: CswRsjV3kH.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: CswRsjV3kH.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: _.pdb source: CswRsjV3kH.exe, 00000000.00000002.1685662213.000000000565E000.00000004.08000000.00040000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000002.1680722858.0000000003137000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1639408489.00000000055CD000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 0_2_05698254
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 0_2_05699ED9
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.0000000003451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $tq3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\tq equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000033B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $tq3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@|- equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.0000000003451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.0000000003451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\tq equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.0000000003451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`,tq equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.0000000003451000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `,tq#www.youtube.com_0.indexeddb.le equals www.youtube.com (Youtube)
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: CswRsjV3kH.exe, 00000000.00000003.1664654420.0000000006225000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664764436.0000000006225000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664462458.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664434642.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: CswRsjV3kH.exe, 00000000.00000003.1654236666.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654472364.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657195062.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658370268.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658538269.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654699594.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658182658.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657286178.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657632244.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654011505.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657918553.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1653941163.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654388886.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654625721.0000000006202000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: CswRsjV3kH.exe, 00000000.00000003.1654159342.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654236666.0000000006202000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comTC
Source: CswRsjV3kH.exe, 00000000.00000003.1653867572.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1653674845.0000000006201000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comfac
Source: CswRsjV3kH.exe, 00000000.00000003.1653867572.0000000006202000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comint
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: CswRsjV3kH.exe, 00000000.00000003.1654998784.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654832344.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654472364.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654699594.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654309116.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654388886.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654625721.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655063802.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654550278.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654944132.0000000006202000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comn-u
Source: CswRsjV3kH.exe, 00000000.00000003.1653867572.0000000006202000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comncy
Source: CswRsjV3kH.exe, 00000000.00000003.1654998784.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654832344.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655063802.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654944132.0000000006202000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comoldbsKCt
Source: CswRsjV3kH.exe, 00000000.00000003.1654998784.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654832344.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654764234.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654699594.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654887659.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654625721.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655063802.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654550278.0000000006202000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1654944132.0000000006202000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comubh
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp, CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000066C000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.enigmaprotector.com/
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://www.enigmaprotector.com/openU
Source: CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664081319.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: CswRsjV3kH.exe, 00000000.00000003.1659428876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: CswRsjV3kH.exe, 00000000.00000003.1659325114.0000000006227000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: CswRsjV3kH.exe, 00000000.00000003.1659356967.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659428876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/.
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: CswRsjV3kH.exe, 00000000.00000003.1663935993.0000000006225000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html.
Source: CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers0
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/jp/
Source: CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/jp/ExKC
Source: CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657452652.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657195062.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657286178.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657632244.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657543806.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/oy
Source: CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com0X
Source: CswRsjV3kH.exe, 00000000.00000003.1659428876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF5y
Source: CswRsjV3kH.exe, 00000000.00000003.1659356967.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comaExKC
Source: CswRsjV3kH.exe, 00000000.00000003.1659356967.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalic
Source: CswRsjV3kH.exe, 00000000.00000003.1660548876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660233223.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659750310.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660459235.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660372621.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comas
Source: CswRsjV3kH.exe, 00000000.00000003.1660645580.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660548876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660233223.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659575709.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659750310.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660459235.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659499318.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660372621.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659642404.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comgritoty
Source: CswRsjV3kH.exe, 00000000.00000003.1660645580.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660548876.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660233223.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659750310.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660459235.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1660372621.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1659824764.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comivta
Source: CswRsjV3kH.exe, 00000000.00000003.1664306645.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1663965051.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664081319.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comoldooy
Source: CswRsjV3kH.exe, 00000000.00000003.1664306645.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1663965051.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664434642.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664081319.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comu
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/oy
Source: CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/qmwB-
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: CswRsjV3kH.exe, 00000000.00000003.1664791143.00000000061F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm)u
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657918553.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658010386.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657543806.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: CswRsjV3kH.exe, 00000000.00000003.1657068872.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//rdNxPCa
Source: CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/1
Source: CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/5y
Source: CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ExKC
Source: CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656492734.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Kurs
Source: CswRsjV3kH.exe, 00000000.00000003.1656940174.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657918553.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657376337.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1658010386.00000000061FC000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1657543806.00000000061FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: CswRsjV3kH.exe, 00000000.00000003.1656362898.00000000061FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/ExKC
Source: CswRsjV3kH.exe, 00000000.00000003.1655846532.00000000061F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/oy
Source: CswRsjV3kH.exe, 00000000.00000003.1656151119.00000000061F3000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1655527565.00000000061F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/oy
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: CswRsjV3kH.exe, 00000000.00000002.1686585727.0000000007362000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1653760373.0000000006208000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: CswRsjV3kH.exe, 00000000.00000003.1653507227.0000000006208000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnS
Source: CswRsjV3kH.exe, 00000000.00000003.1653507227.0000000006208000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cns
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.000000000341C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.s
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.000000000341C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.sb/ip
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000033B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/v9/users/
Installs a raw input device (often for capturing keystrokes)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000035E3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_dc51b542-f
Yara detected Keylogger Generic
Source: Yara match File source: Process Memory Space: CswRsjV3kH.exe PID: 7536, type: MEMORYSTR
Drops certificate files (DER)
Source: C:\Users\user\Desktop\CswRsjV3kH.exe File created: C:\Users\user\AppData\Local\Temp\TmpDBE7.tmp Jump to dropped file
Source: C:\Users\user\Desktop\CswRsjV3kH.exe File created: C:\Users\user\AppData\Local\Temp\TmpDBC7.tmp Jump to dropped file

System Summary
barindex
.NET source code contains very large array initializations
Source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, Strings.cs Large array initialization: Strings: array initializer size 6160
Source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, Strings.cs Large array initialization: Strings: array initializer size 6160
Source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, Strings.cs Large array initialization: Strings: array initializer size 6160
Source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, Strings.cs Large array initialization: Strings: array initializer size 6160
Source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, Strings.cs Large array initialization: Strings: array initializer size 6160
Source: 0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack, Strings.cs Large array initialization: Strings: array initializer size 6160
PE file has nameless sections
Source: CswRsjV3kH.exe Static PE information: section name:
Source: CswRsjV3kH.exe Static PE information: section name:
Source: CswRsjV3kH.exe Static PE information: section name:
Source: CswRsjV3kH.exe Static PE information: section name:
Source: CswRsjV3kH.exe Static PE information: section name:
Detected potential crypto function
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_0320B040 0_2_0320B040
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_056970A8 0_2_056970A8
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_05697098 0_2_05697098
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_0569509C 0_2_0569509C
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_072EA29C 0_2_072EA29C
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_072E8028 0_2_072E8028
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_072E3AFC 0_2_072E3AFC
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_072E44B9 0_2_072E44B9
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_09348198 0_2_09348198
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_093489B8 0_2_093489B8
Enables security privileges
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process token adjusted: Security Jump to behavior
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: String function: 0050F264 appears 47 times
Sample file is different than original file name gathered from version info
Source: CswRsjV3kH.exe, 00000000.00000002.1685894112.0000000005E0D000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000003.1673844031.0000000004783000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000003.1673844031.0000000004551000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000003.1638897189.0000000000B78000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMsMpLics.dllj% vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1685662213.000000000565E000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1685662213.000000000565E000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1680722858.0000000003137000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1680722858.0000000003137000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000003.1639408489.00000000055CD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000003.1639408489.00000000055CD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1685108688.00000000044AC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000000.1634992563.00000000004EF000.00000080.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1678970760.00000000004EF000.00000080.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Source: CswRsjV3kH.exe Binary or memory string: OriginalFilenameStrobiloid.exe" vs CswRsjV3kH.exe
Uses 32bit PE files
Source: CswRsjV3kH.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: CswRsjV3kH.exe Static PE information: Section: ZLIB complexity 0.9938467920353983
Source: CswRsjV3kH.exe Static PE information: Section: ZLIB complexity 0.9993669519472361
Source: CswRsjV3kH.exe Static PE information: Section: .data ZLIB complexity 0.9971359185710352
Source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, PBE.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, Strings.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, PBE.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, Strings.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, PBE.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, Strings.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, PBE.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, Strings.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, PBE.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, Strings.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack, PBE.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, Strings.cs Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, Strings.cs Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, Strings.cs Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, Strings.cs Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, Strings.cs Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: 0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack, Strings.cs Base64 encoded string: 'JjgkEDEHHhMUBAJXMC4rVyBfOFYoWyA1Gl8jUgcxIC0XXRoQNFkWFgwrAisxWRYiEF44DytbDVUhFV5a'
Source: classification engine Classification label: mal88.troj.evad.winEXE@2/5@0/0
Source: C:\Users\user\Desktop\CswRsjV3kH.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06 Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03
Source: C:\Users\user\Desktop\CswRsjV3kH.exe File created: C:\Users\user\AppData\Local\Temp\TmpDBC7.tmp Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe File read: C:\Program Files (x86)\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: CswRsjV3kH.exe ReversingLabs: Detection: 50%
Source: CswRsjV3kH.exe Virustotal: Detection: 36%
Source: C:\Users\user\Desktop\CswRsjV3kH.exe File read: C:\Users\user\Desktop\CswRsjV3kH.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\CswRsjV3kH.exe "C:\Users\user\Desktop\CswRsjV3kH.exe"
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: esdsip.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Google Chrome.lnk.0.dr LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe
Source: C:\Users\user\Desktop\CswRsjV3kH.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: CswRsjV3kH.exe Static file information: File size 1762816 > 1048576
Source: Binary string: _.pdb source: CswRsjV3kH.exe, 00000000.00000002.1685662213.000000000565E000.00000004.08000000.00040000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000002.1680722858.0000000003137000.00000004.00000800.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000003.1639408489.00000000055CD000.00000004.00000020.00020000.00000000.sdmp, CswRsjV3kH.exe, 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Unpacked PE file: 0.2.CswRsjV3kH.exe.400000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;.rsrc:EW;Unknown_Section5:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;.rsrc:EW;Unknown_Section5:EW;.data:EW;
PE file contains an invalid checksum
Source: CswRsjV3kH.exe Static PE information: real checksum: 0x23bfb should be: 0x1b5ee8
PE file contains sections with non-standard names
Source: CswRsjV3kH.exe Static PE information: section name:
Source: CswRsjV3kH.exe Static PE information: section name:
Source: CswRsjV3kH.exe Static PE information: section name:
Source: CswRsjV3kH.exe Static PE information: section name:
Source: CswRsjV3kH.exe Static PE information: section name:
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_005133EA push 00513418h; ret 0_2_00513410
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_005243A0 push 00524400h; ret 0_2_005243F8
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00524456 push 005245A4h; ret 0_2_0052459C
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00525454 push 005254A1h; ret 0_2_00525499
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_0051345C push 00513488h; ret 0_2_00513480
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00513424 push 00513450h; ret 0_2_00513448
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_005134F8 push 0051352Ch; ret 0_2_00513524
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00513494 push 005134C0h; ret 0_2_005134B8
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00523536 push 005235B5h; ret 0_2_005235AD
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_005115F0 push 00511641h; ret 0_2_00511639
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_0052262C push 005226A2h; ret 0_2_0052269A
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_0051B6DA push 0051B74Bh; ret 0_2_0051B743
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00524684 push ecx; mov dword ptr [esp], ecx 0_2_00524687
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_005226A4 push 0052274Ch; ret 0_2_00522744
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_0052274E push 0052279Ch; ret 0_2_00522794
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_0051B85E push 0051B88Ch; ret 0_2_0051B884
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00523804 push 00523830h; ret 0_2_00523828
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_005248F4 push ecx; mov dword ptr [esp], ecx 0_2_005248F6
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_005118AA push 005118D8h; ret 0_2_005118D0
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00511968 push 00511994h; ret 0_2_0051198C
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00512A48 push ecx; mov dword ptr [esp], eax 0_2_00512A49
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00512CF2 push 00512D20h; ret 0_2_00512D18
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_0051AD60 push ecx; mov dword ptr [esp], edx 0_2_0051AD65
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_00512D2C push 00512D58h; ret 0_2_00512D50
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_0050DF90 push eax; ret 0_2_0050DFCC
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_05698F21 push 0C418B05h; ret 0_2_05698F33
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_05698E81 push 1C418B05h; ret 0_2_05698E93
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_0934550F push dword ptr [esp+ecx*2-75h]; ret 0_2_09345513
Source: CswRsjV3kH.exe Static PE information: section name: entropy: 7.990134528702455
Source: CswRsjV3kH.exe Static PE information: section name: entropy: 7.94187495363733
Source: CswRsjV3kH.exe Static PE information: section name: entropy: 7.276454522865523
Source: CswRsjV3kH.exe Static PE information: section name: entropy: 7.9988804946234415
Source: CswRsjV3kH.exe Static PE information: section name: .data entropy: 7.982788491977175

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE`,TQ
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE@\TQ
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE@|-
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Memory allocated: 31C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Memory allocated: 33B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Memory allocated: 53B0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\CswRsjV3kH.exe TID: 7600 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe@\tq
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: VBoxService.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe`,tq
Source: CswRsjV3kH.exe, 00000000.00000002.1686161317.0000000005F71000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\M
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000034AE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe
Source: CswRsjV3kH.exe, CswRsjV3kH.exe, 00000000.00000002.1679039317.0000000000651000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: ~VirtualMachineTypes
Source: CswRsjV3kH.exe, CswRsjV3kH.exe, 00000000.00000002.1679039317.0000000000651000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: ]DLL_Loader_VirtualMachine
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: VMWare
Source: CswRsjV3kH.exe, 00000000.00000003.1677397008.0000000005F70000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.0000000000651000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: CswRsjV3kH.exe, 00000000.00000002.1679039317.000000000050B000.00000040.00000001.01000000.00000003.sdmp Binary or memory string: &VBoxService.exe
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe@|-

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Thread information set: HideFromDebugger Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_02774448 mov eax, dword ptr fs:[00000030h] 0_2_02774448
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Code function: 0_2_02774448 mov eax, dword ptr fs:[00000030h] 0_2_02774448
Enables debug privileges
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Memory allocated: page read and write | page guard Jump to behavior
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000035E3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: GetProgmanWindow
Source: CswRsjV3kH.exe, 00000000.00000002.1681073229.00000000035E3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SetProgmanWindow
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\CswRsjV3kH.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.CswRsjV3kH.exe.555ff08.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.55f0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.30c9f16.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.5da0000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.43b6458.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.55f0ee8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.55f0000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.443f790.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1680722858.00000000030C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1685662213.00000000055F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1685108688.00000000043B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1639408489.000000000555F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1685894112.0000000005DA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 0.2.CswRsjV3kH.exe.43b6458.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.CswRsjV3kH.exe.555ff08.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.55f0ee8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.55f0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.30c9f16.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.443f790.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.5da0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.30c9f16.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.5da0000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.CswRsjV3kH.exe.555ff08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.43b6458.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.55f0ee8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.55f0000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.443f790.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.CswRsjV3kH.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1680722858.00000000030C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1685662213.00000000055F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1685108688.00000000043B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1639408489.000000000555F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1685108688.0000000004423000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1685894112.0000000005DA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1429015 Sample: CswRsjV3kH.exe Startdate: 20/04/2024 Architecture: WINDOWS Score: 88 11 Multi AV Scanner detection for submitted file 2->11 13 Yara detected RedLine Stealer 2->13 15 .NET source code contains very large array initializations 2->15 17 2 other signatures 2->17 6 CswRsjV3kH.exe 1 24 2->6         started        process3 signatures4 19 Detected unpacking (changes PE section rights) 6->19 21 Installs new ROOT certificates 6->21 23 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 6->23 25 Hides threads from debuggers 6->25 9 conhost.exe 6->9         started        process5
⊘No contacted IP infos