Loading ...

Play interactive tourEdit tour

Analysis Report PO279476798.exe

Overview

General Information

Sample Name:PO279476798.exe
Analysis ID:286436
MD5:da2463ee710cf1233d7af8d1ece47d0a
SHA1:128273d895b7085414e0b6859cd045aee6a4eaa3
SHA256:13f96451e9e4a07f4644b225e93b510a8b226dd77d1d5d6b2c04e3d51681a4c7
Tags:AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • PO279476798.exe (PID: 1416 cmdline: 'C:\Users\user\Desktop\PO279476798.exe' MD5: DA2463EE710CF1233D7AF8D1ECE47D0A)
    • RegSvcs.exe (PID: 1748 cmdline: {path} MD5: 71369277D09DA0830C8C59F9E22BB23A)
  • DsWhv.exe (PID: 4856 cmdline: 'C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exe' MD5: 71369277D09DA0830C8C59F9E22BB23A)
    • conhost.exe (PID: 852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • DsWhv.exe (PID: 4676 cmdline: 'C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exe' MD5: 71369277D09DA0830C8C59F9E22BB23A)
    • conhost.exe (PID: 6896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "J6vjFNONdf6hQ", "URL: ": "http://cAdwQ8iUlwqdAnFRp.net", "To: ": "", "ByHost: ": "mail.cortlandfire.org:587", "Password: ": "en8HzIJslH", "From: ": ""}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.443206422.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000000.00000002.200975506.0000000003BE8000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000001.00000002.446909063.0000000003731000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000001.00000002.447247740.00000000037F6000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000001.00000002.447247740.00000000037F6000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              No Sigma rule has matched

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Found malware configurationShow sources
              Source: RegSvcs.exe.1748.1.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "J6vjFNONdf6hQ", "URL: ": "http://cAdwQ8iUlwqdAnFRp.net", "To: ": "", "ByHost: ": "mail.cortlandfire.org:587", "Password: ": "en8HzIJslH", "From: ": ""}
              Multi AV Scanner detection for submitted fileShow sources
              Source: PO279476798.exeVirustotal: Detection: 38%Perma Link
              Source: PO279476798.exeReversingLabs: Detection: 29%
              Machine Learning detection for sampleShow sources
              Source: PO279476798.exeJoe Sandbox ML: detected
              Source: 1.2.RegSvcs.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
              Source: global trafficTCP traffic: 192.168.2.6:49734 -> 35.208.151.201:587
              Source: Joe Sandbox ViewASN Name: GOOGLE-2US GOOGLE-2US
              Source: global trafficTCP traffic: 192.168.2.6:49734 -> 35.208.151.201:587
              Source: unknownDNS traffic detected: queries for: mail.cortlandfire.org
              Source: PO279476798.exe, 00000000.00000002.200975506.0000000003BE8000.00000004.00000001.sdmp, RegSvcs.exe, 00000001.00000002.443206422.0000000000402000.00000040.00000001.sdmpString found in binary or memory: http://127.0.0.1:
              Source: RegSvcs.exe, 00000001.00000002.447247740.00000000037F6000.00000004.00000001.sdmp, RegSvcs.exe, 00000001.00000002.448060735.000000000395B000.00000004.00000001.sdmpString found in binary or memory: http://cAdwQ8iUlwqdAnFRp.net
              Source: RegSvcs.exe, 00000001.00000002.447247740.00000000037F6000.00000004.00000001.sdmpString found in binary or memory: http://cAdwQ8iUlwqdAnFRp.net0
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
              Source: PO279476798.exe, 00000000.00000002.203278178.0000000006530000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/DataSet1.xsd
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
              Source: PO279476798.exe, 00000000.00000003.182102241.0000000004EF6000.00000004.00000001.sdmpString found in binary or memory: http://www.ascendercorp.com/8
              Source: PO279476798.exe, 00000000.00000003.181420487.0000000004EB9000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
              Source: PO279476798.exe, 00000000.00000003.181420487.0000000004EB9000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com-gA
              Source: PO279476798.exe, 00000000.00000003.181420487.0000000004EB9000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com.
              Source: PO279476798.exe, 00000000.00000003.181420487.0000000004EB9000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comX
              Source: PO279476798.exe, 00000000.00000003.181420487.0000000004EB9000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.come
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
              Source: PO279476798.exe, 00000000.00000003.183720763.0000000004EB7000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
              Source: PO279476798.exe, 00000000.00000002.199319908.0000000000E37000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comm
              Source: PO279476798.exe, 00000000.00000002.199319908.0000000000E37000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.commc
              Source: PO279476798.exe, 00000000.00000003.179643416.0000000004EEE000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
              Source: PO279476798.exe, 00000000.00000003.179643416.0000000004EEE000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comIh
              Source: PO279476798.exe, 00000000.00000003.179028278.0000000004ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comW
              Source: PO279476798.exe, 00000000.00000003.181018413.0000000004EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.c
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
              Source: PO279476798.exe, 00000000.00000003.180373811.0000000004EB9000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.krom
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
              Source: PO279476798.exe, 00000000.00000003.185462190.0000000004EEE000.00000004.00000001.sdmpString found in binary or memory: http://www.monotype.
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
              Source: PO279476798.exe, 00000000.00000003.182102241.0000000004EF6000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com-uR9k
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
              Source: PO279476798.exe, 00000000.00000003.180373811.0000000004EB9000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krw
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmp, PO279476798.exe, 00000000.00000003.181420487.0000000004EB9000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
              Source: PO279476798.exe, 00000000.00000003.179331766.0000000004ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.net
              Source: PO279476798.exe, 00000000.00000003.179465391.0000000004ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.net-es20
              Source: PO279476798.exe, 00000000.00000003.179331766.0000000004ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.net20Fr
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
              Source: PO279476798.exe, 00000000.00000003.179331766.0000000004ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netft
              Source: PO279476798.exe, 00000000.00000003.179465391.0000000004ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.neton%r
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
              Source: PO279476798.exe, 00000000.00000003.183720763.0000000004EB7000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deoiK
              Source: PO279476798.exe, 00000000.00000002.201897940.0000000005020000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
              Source: PO279476798.exe, 00000000.00000002.200975506.0000000003BE8000.00000004.00000001.sdmp, RegSvcs.exe, 00000001.00000002.443206422.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: PO279476798.exe, 00000000.00000002.200975506.0000000003BE8000.00000004.00000001.sdmp, RegSvcs.exe, 00000001.00000002.443206422.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: PO279476798.exe, 00000000.00000002.200975506.0000000003BE8000.00000004.00000001.sdmp, RegSvcs.exe, 00000001.00000002.443206422.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/U
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_04D6107A NtQuerySystemInformation,0_2_04D6107A
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_04D6103F NtQuerySystemInformation,0_2_04D6103F
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02826AC00_2_02826AC0
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_028252D30_2_028252D3
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02824AF80_2_02824AF8
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02822E300_2_02822E30
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282BB780_2_0282BB78
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282CC880_2_0282CC88
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282D8200_2_0282D820
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02825C480_2_02825C48
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_028255F00_2_028255F0
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_028201100_2_02820110
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_028229210_2_02822921
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02823E870_2_02823E87
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02828A2B0_2_02828A2B
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02828A380_2_02828A38
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02824A400_2_02824A40
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02828E400_2_02828E40
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282C6480_2_0282C648
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282CE780_2_0282CE78
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282575B0_2_0282575B
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282988F0_2_0282988F
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282C0990_2_0282C099
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282C0A80_2_0282C0A8
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_028288490_2_02828849
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_028288580_2_02828858
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02828C580_2_02828C58
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_02828C680_2_02828C68
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_028269CF0_2_028269CF
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_028201000_2_02820100
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_069600060_2_06960006
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_069600700_2_06960070
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A075101_2_05A07510
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A015581_2_05A01558
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0C0E81_2_05A0C0E8
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A034F81_2_05A034F8
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0E0DD1_2_05A0E0DD
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_059F00061_2_059F0006
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0E4001_2_05A0E400
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A02C181_2_05A02C18
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0DBE51_2_05A0DBE5
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0B3F01_2_05A0B3F0
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0F3F91_2_05A0F3F9
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0AFC01_2_05A0AFC0
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A06E7B1_2_05A06E7B
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A01D811_2_05A01D81
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0A9C21_2_05A0A9C2
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A021CF1_2_05A021CF
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A015481_2_05A01548
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0215E1_2_05A0215E
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A074FF1_2_05A074FF
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A054251_2_05A05425
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A02C091_2_05A02C09
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0A8601_2_05A0A860
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A057101_2_05A05710
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A034F81_2_05A034F8
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A066BD1_2_05A066BD
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0561D1_2_05A0561D
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B64601_2_064B6460
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B10101_2_064B1010
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B86381_2_064B8638
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B0AC81_2_064B0AC8
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B5EC01_2_064B5EC0
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B34D81_2_064B34D8
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B20F81_2_064B20F8
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B76901_2_064B7690
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B68B81_2_064B68B8
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B6CBE1_2_064B6CBE
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B19401_2_064B1940
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B73401_2_064B7340
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B5F7D1_2_064B5F7D
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B01001_2_064B0100
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B83301_2_064B8330
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B7BD01_2_064B7BD0
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B3D981_2_064B3D98
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B38581_2_064B3858
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B64501_2_064B6450
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B360C1_2_064B360C
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B10021_2_064B1002
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B86281_2_064B8628
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B34C81_2_064B34C8
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B4AE01_2_064B4AE0
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B20E71_2_064B20E7
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B76821_2_064B7682
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B68AA1_2_064B68AA
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B4AA81_2_064B4AA8
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B0AB91_2_064B0AB9
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B5EB01_2_064B5EB0
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B4B0D1_2_064B4B0D
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B732F1_2_064B732F
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B83221_2_064B8322
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B19311_2_064B1931
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B61D21_2_064B61D2
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B3D881_2_064B3D88
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B5F9E1_2_064B5F9E
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B19BE1_2_064B19BE
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B63BE1_2_064B63BE
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exe D4527B7AD2FC4778CC5BE8709C95AEA44EAC0568B367EE14F7357D72898C3698
              Source: PO279476798.exe, 00000000.00000002.200975506.0000000003BE8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameB2B.exe4 vs PO279476798.exe
              Source: PO279476798.exe, 00000000.00000002.200975506.0000000003BE8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamefOYqIPZhzSDrJVcPTrqYmeb.exe4 vs PO279476798.exe
              Source: PO279476798.exe, 00000000.00000002.199980035.0000000002B91000.00000004.00000001.sdmpBinary or memory string: OriginalFilename vs PO279476798.exe
              Source: PO279476798.exe, 00000000.00000002.201537918.0000000004D80000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dll.muij% vs PO279476798.exe
              Source: PO279476798.exe, 00000000.00000000.177705636.00000000004BC000.00000002.00020000.sdmpBinary or memory string: OriginalFilename4mO.exe( vs PO279476798.exe
              Source: PO279476798.exe, 00000000.00000002.201511560.0000000004D70000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dllj% vs PO279476798.exe
              Source: PO279476798.exe, 00000000.00000002.203301982.0000000006550000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs PO279476798.exe
              Source: PO279476798.exe, 00000000.00000002.203278178.0000000006530000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameWinRar.dll. vs PO279476798.exe
              Source: PO279476798.exeBinary or memory string: OriginalFilename4mO.exe( vs PO279476798.exe
              Source: PO279476798.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/5@1/1
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_04D60AC6 AdjustTokenPrivileges,0_2_04D60AC6
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_04D60A8F AdjustTokenPrivileges,0_2_04D60A8F
              Source: C:\Users\user\Desktop\PO279476798.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\PO279476798.exe.logJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6896:120:WilError_01
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:852:120:WilError_01
              Source: PO279476798.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\PO279476798.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\PO279476798.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: PO279476798.exeVirustotal: Detection: 38%
              Source: PO279476798.exeReversingLabs: Detection: 29%
              Source: unknownProcess created: C:\Users\user\Desktop\PO279476798.exe 'C:\Users\user\Desktop\PO279476798.exe'
              Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}
              Source: unknownProcess created: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exe 'C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exe'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exe 'C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exe'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\PO279476798.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: PO279476798.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: C:\Users\user\Desktop\PO279476798.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
              Source: PO279476798.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
              Source: Binary string: System.EnterpriseServices.Wrapper.pdb source: DsWhv.exe, 00000008.00000002.268867842.0000000005650000.00000002.00000001.sdmp
              Source: Binary string: RegSvcs.pdb source: DsWhv.exe, DsWhv.exe.1.dr
              Source: Binary string: vcs.pdb source: RegSvcs.exe, 00000001.00000003.307643164.000000000176B000.00000004.00000001.sdmp
              Source: Binary string: mscorrc.pdb source: PO279476798.exe, 00000000.00000002.203301982.0000000006550000.00000002.00000001.sdmp, RegSvcs.exe, 00000001.00000002.449115434.00000000064E0000.00000002.00000001.sdmp

              Data Obfuscation:

              barindex
              .NET source code contains method to dynamically call methods (often used by packers)Show sources
              Source: PO279476798.exe, job/SparseArray.cs.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, io }, null, null)
              Source: 0.0.PO279476798.exe.430000.0.unpack, job/SparseArray.cs.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, io }, null, null)
              Source: 0.2.PO279476798.exe.430000.0.unpack, job/SparseArray.cs.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, io }, null, null)
              .NET source code contains potential unpackerShow sources
              Source: PO279476798.exe, job/SparseArray.cs.Net Code: M__________ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 0.0.PO279476798.exe.430000.0.unpack, job/SparseArray.cs.Net Code: M__________ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 0.2.PO279476798.exe.430000.0.unpack, job/SparseArray.cs.Net Code: M__________ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282A9D6 push ebp; retf 0_2_0282A9D7
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0282A9E0 push ebp; retf 0_2_0282A9E1
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_06961097 pushfd ; retf 0_2_06961098
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_06961499 push es; ret 0_2_069614A8
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_069603A4 push ecx; ret 0_2_069603A5
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_069614F6 push es; iretd 0_2_069614F8
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_06961420 push es; retf 0_2_06961498
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_0696145E push es; retf 0_2_06961498
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_032E0A8F push ss; iretd 1_2_032E0B3B
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A06CF8 push 8BD04589h; iretd 1_2_05A06D06
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A0402E push eax; retn 0007h1_2_05A04034
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A04ED6 push es; iretd 1_2_05A04ED7
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_064B4A18 push es; retn 4B59h1_2_064B5BE8
              Source: initial sampleStatic PE information: section name: .text entropy: 7.97969496606
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile created: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeJump to dropped file
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run DsWhvJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run DsWhvJump to behavior

              Hooking and other Techniques for Hiding and Protection:

              barindex
              Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exe:Zone.Identifier read attributes | deleteJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Yara detected AntiVM_3Show sources
              Source: Yara matchFile source: Process Memory Space: PO279476798.exe PID: 1416, type: MEMORY
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
              Source: PO279476798.exe, 00000000.00000002.200025896.0000000002BC9000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
              Source: PO279476798.exe, 00000000.00000002.200025896.0000000002BC9000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
              Source: C:\Users\user\Desktop\PO279476798.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exe TID: 1420Thread sleep time: -33000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exe TID: 1548Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exe TID: 3448Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\DsWhv\DsWhv.exe TID: 2964Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeLast function: Thread delayed
              Source: RegSvcs.exe, 00000001.00000002.448709778.0000000005F10000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: PO279476798.exe, 00000000.00000002.200025896.0000000002BC9000.00000004.00000001.sdmpBinary or memory string: vmware
              Source: PO279476798.exe, 00000000.00000002.200025896.0000000002BC9000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: PO279476798.exe, 00000000.00000002.200025896.0000000002BC9000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
              Source: PO279476798.exe, 00000000.00000002.200025896.0000000002BC9000.00000004.00000001.sdmpBinary or memory string: VMWARE
              Source: PO279476798.exe, 00000000.00000002.200025896.0000000002BC9000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: RegSvcs.exe, 00000001.00000002.448709778.0000000005F10000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: RegSvcs.exe, 00000001.00000002.448709778.0000000005F10000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: RegSvcs.exe, 00000001.00000002.449208826.0000000006540000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
              Source: PO279476798.exe, 00000000.00000002.200025896.0000000002BC9000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
              Source: PO279476798.exe, 00000000.00000002.200025896.0000000002BC9000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
              Source: PO279476798.exe, 00000000.00000002.200025896.0000000002BC9000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
              Source: RegSvcs.exe, 00000001.00000002.448709778.0000000005F10000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\PO279476798.exeProcess information queried: ProcessInformationJump to behavior

              Anti Debugging:

              barindex
              Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)Show sources
              Source: C:\Users\user\Desktop\PO279476798.exeCode function: 0_2_00D8A172 CheckRemoteDebuggerPresent,0_2_00D8A172
              Source: C:\Users\user\Desktop\PO279476798.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess queried: DebugPortJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_05A034F8 KiUserExceptionDispatcher,KiUserExceptionDispatcher,LdrInitializeThunk,KiUserExceptionDispatcher,1_2_05A034F8
              Source: C:\Users\user\Desktop\PO279476798.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Allocates memory in foreign processesShow sources
              Source: C:\Users\user\Desktop\PO279476798.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000 protect: page execute and read and writeJump to behavior
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\PO279476798.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000 value starts with: 4D5AJump to behavior
              Writes to foreign memory regionsShow sources
              Source: C:\Users\user\Desktop\PO279476798.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000Jump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 402000Jump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 462000Jump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 464000Jump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 10AF008Jump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}Jump to behavior
              Source: RegSvcs.exe, 00000001.00000002.445019787.0000000001D20000.00000002.00000001.sdmpBinary or memory string: Program Manager
              Source: RegSvcs.exe, 00000001.00000002.445019787.0000000001D20000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: RegSvcs.exe, 00000001.00000002.445019787.0000000001D20000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: RegSvcs.exe, 00000001.00000002.445019787.0000000001D20000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PO279476798.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf Volu