Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.28577

Overview

General Information

Sample Name:SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.28577 (renamed file extension from 28577 to exe)
Analysis ID:323824
MD5:224e779ff4d39ce90878ae3e630197e7
SHA1:e248c7182cbfb6679ab327bbe77a9eb469121ac8
SHA256:92d9b1922bebbb60f7ca75eb99220f92bbdf687af32a4a966ec90fd562dfe96e
Tags:AgentTesla

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • vlc.exe (PID: 4120 cmdline: 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe' MD5: 224E779FF4D39CE90878AE3E630197E7)
    • vlc.exe (PID: 6384 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 224E779FF4D39CE90878AE3E630197E7)
    • vlc.exe (PID: 6400 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 224E779FF4D39CE90878AE3E630197E7)
  • vlc.exe (PID: 6268 cmdline: 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe' MD5: 224E779FF4D39CE90878AE3E630197E7)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "D1veT2GUQ", "URL: ": "https://6Myp18QaIbJyfOWJxc.com", "To: ": "", "ByHost: ": "mail.baharanvilla.ir:587", "Password: ": "SrT57YCz2", "From: ": ""}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000000.00000002.263990752.0000000003129000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000002.00000002.500003272.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000002.00000002.505873536.0000000002B55000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 14 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            13.2.vlc.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              2.2.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

                Sigma Overview

                No Sigma rule has matched

                Signature Overview

                Click to jump to signature section

                Show All Signature Results

                AV Detection:

                barindex
                Found malware configurationShow sources
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.2844.2.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "D1veT2GUQ", "URL: ": "https://6Myp18QaIbJyfOWJxc.com", "To: ": "", "ByHost: ": "mail.baharanvilla.ir:587", "Password: ": "SrT57YCz2", "From: ": ""}
                Multi AV Scanner detection for dropped fileShow sources
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeReversingLabs: Detection: 37%
                Multi AV Scanner detection for submitted fileShow sources
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeVirustotal: Detection: 31%Perma Link
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeReversingLabs: Detection: 37%
                Machine Learning detection for dropped fileShow sources
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJoe Sandbox ML: detected
                Machine Learning detection for sampleShow sources
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeJoe Sandbox ML: detected
                Source: 2.2.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                Source: 13.2.vlc.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\

                Networking:

                barindex
                Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49739 -> 185.165.40.194:587
                May check the online IP address of the machineShow sources
                Source: unknownDNS query: name: api.ipify.org
                Source: unknownDNS query: name: api.ipify.org
                Source: unknownDNS query: name: api.ipify.org
                Source: unknownDNS query: name: api.ipify.org
                Source: unknownDNS query: name: api.ipify.org
                Source: unknownDNS query: name: api.ipify.org
                Source: Joe Sandbox ViewIP Address: 54.225.169.28 54.225.169.28
                Source: Joe Sandbox ViewIP Address: 54.225.169.28 54.225.169.28
                Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                Source: unknownDNS traffic detected: queries for: api.ipify.org
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, vlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                Source: vlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.507519954.0000000002DBC000.00000004.00000001.sdmpString found in binary or memory: http://baharanvilla.ir
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000003.495028707.0000000000DDB000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505816927.0000000002B3B000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232384565.0000000005E13000.00000004.00000001.sdmpString found in binary or memory: http://en.wikip
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                Source: vlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpString found in binary or memory: http://lMzSbX.com
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.507519954.0000000002DBC000.00000004.00000001.sdmpString found in binary or memory: http://mail.baharanvilla.ir
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000003.495028707.0000000000DDB000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505816927.0000000002B3B000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                Source: vlc.exeString found in binary or memory: http://schemas.microso
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.234655964.0000000005DF2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.234598135.0000000005DF2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com1
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.234655964.0000000005DF2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comTCQ
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.234598135.0000000005DF2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comZs
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.234598135.0000000005DF2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comrl
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238626941.0000000005E14000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238595635.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/
                Source: vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239721532.0000000005E2E000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers#6Gs
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238553956.0000000005E2E000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239224806.0000000005E2E000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239940201.0000000005E2E000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers96-s
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.244267564.0000000005E2E000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersL6
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238855975.0000000005E2E000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersU
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238939245.0000000005E2E000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersers
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238577684.0000000005E2E000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designerss7
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239451545.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comB.TTF
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240319258.0000000005E13000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comCq
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239207194.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240319258.0000000005E13000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comT.TTF
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.244296179.0000000005E12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.coma
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.244250202.0000000005E12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comce9
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238679080.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comcom/
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239333550.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comcomF
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239451545.0000000005E14000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238986582.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239403264.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd9
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239263737.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd?
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239059251.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comiono
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239059251.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.commyq
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238565181.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comnap/
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239451545.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.como
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239550906.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comsief
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238874107.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comueedoq$s$
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232604882.0000000005E0B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comp
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240839268.0000000005E12000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240891546.0000000005E12000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240847379.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240847379.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/O
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240839268.0000000005E12000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/Tq9sp
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.241174877.0000000005DF2000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.260481176.0000000005DF0000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmI
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237159352.0000000005E14000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237159352.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/-ca(qes
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237159352.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/1q
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237159352.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/:qWs
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.236224002.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Cq
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.236395168.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/R
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.235672179.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0t0
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.236224002.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/fq
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.236224002.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.236224002.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/yq
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237159352.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/t
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237950566.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/tTq9sp
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.235672179.0000000005E14000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/yq
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237106452.0000000005E36000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com0
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.233475482.0000000005DFA000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krrsy
                Source: vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232850879.0000000005E0B000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.net-u
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232850879.0000000005E0B000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netK~
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232879628.0000000005E0B000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netief
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232879628.0000000005E0B000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netlique
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.233119604.0000000005E0B000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netrz
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232879628.0000000005E0B000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.nett
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232850879.0000000005E0B000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netw~
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240089803.0000000005DF2000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.de
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240089803.0000000005DF2000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deFT
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505873536.0000000002B55000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.507621145.0000000002DC9000.00000004.00000001.sdmpString found in binary or memory: https://6Myp18QaIbJyfOWJxc.com
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org/
                Source: vlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.263990752.0000000003129000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.500003272.0000000000402000.00000040.00000001.sdmp, vlc.exe, 00000005.00000002.314707894.00000000026E8000.00000004.00000001.sdmp, vlc.exe, 0000000D.00000002.500027054.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, vlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505816927.0000000002B3B000.00000004.00000001.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.263990752.0000000003129000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.500003272.0000000000402000.00000040.00000001.sdmp, vlc.exe, 00000005.00000002.314707894.00000000026E8000.00000004.00000001.sdmp, vlc.exe, 0000000D.00000002.500027054.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, vlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
                Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443

                System Summary:

                barindex
                .NET source code contains very large array initializationsShow sources
                Source: 13.2.vlc.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bD4422BF3u002d6DCDu002d43DAu002dA01Bu002d2B0FB8573FD7u007d/u0034ED6FEA3u002d4D2Eu002d48F7u002dA22Cu002d75AD12705C07.csLarge array initialization: .cctor: array initializer size 11994
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 0_2_02ECC284
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 0_2_02ECE640
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 0_2_02ECE650
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 0_2_05FCED10
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 0_2_05FC2B58
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_010447B2
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_0104D800
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06412618
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_0641D318
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_0641AE70
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06411FE0
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06412D50
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_0641F878
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_0641C560
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06427680
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_0642A420
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06422CF0
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06429A48
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06424368
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06420678
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_0642E4A8
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_0643DB70
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06434B79
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_023DC284
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_023DE650
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_023DE640
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_06960660
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_0696BDA8
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_06960651
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_069603DA
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_069603E8
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_06965B5A
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_06965B60
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_0697C478
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_0697BBA8
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_06977757
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_0697B860
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_027AC284
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_027AE650
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_027AE640
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_054DCD40
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_054DB708
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_054D1E49
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_054D1E58
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_054D1638
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_054DD858
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_054DA330
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_06AF0448
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_06AF25D0
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_06AF2D30
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_06AF6158
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_06AF3A50
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.263990752.0000000003129000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameClassLibrary3.dll< vs SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.263990752.0000000003129000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAaaxwmgwKAANnoYbOIjKShbygzcv.exe4 vs SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.264115098.00000000040A1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDljjjhuvckoid.dll4 vs SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.271114025.00000000075BF000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNmsdmwkbi4.exe4 vs SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.500003272.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameAaaxwmgwKAANnoYbOIjKShbygzcv.exe4 vs SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.513648434.0000000006440000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.513448698.00000000063E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeBinary or memory string: OriginalFilenameNmsdmwkbi4.exe4 vs SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: vlc.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: 13.2.vlc.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                Source: 13.2.vlc.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@9/4@5/1
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLANJump to behavior
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeVirustotal: Detection: 31%
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeReversingLabs: Detection: 37%
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe'
                Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
                Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
                Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 0_2_02ECFAE4 pushfd ; iretd
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 0_2_02ECFA10 push esp; iretd
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 0_2_05FC1548 push dword ptr [edx+edx-75h]; iretd
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_01045522 push ss; iretd
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06410040 push es; retf
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06411045 push es; ret
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06411049 push es; ret
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_064110D9 push es; ret
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_064110DD push es; ret
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06411092 push es; ret
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_064110A2 push es; ret
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06416175 push es; iretd
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06410EC1 push es; ret
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_06417A37 push edi; retn 0000h
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_023DFA10 push esp; iretd
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_023DFAE4 pushfd ; iretd
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_0696C6EB push eax; iretd
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_06960FE1 push es; ret
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_0696C73A push 84068ECFh; iretd
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_06967A70 push es; ret
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_0697ECA3 pushfd ; iretd
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_06972DA7 push es; retf
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_0697EBEB pushad ; iretd
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_06972B52 push es; iretd
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_027AFA10 push esp; iretd
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_027AFAE4 pushfd ; iretd
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 10_2_054DF5C9 push esp; retf
                Source: initial sampleStatic PE information: section name: .text entropy: 7.96339396764
                Source: initial sampleStatic PE information: section name: .text entropy: 7.96339396764
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: vlc.exe.0.dr, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: vlc.exe.0.dr, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 0.0.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.a50000.0.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 0.0.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.a50000.0.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 0.2.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.a50000.0.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 0.2.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.a50000.0.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 2.2.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.790000.1.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 2.2.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.790000.1.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 2.0.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.790000.0.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 2.0.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.790000.0.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 5.2.vlc.exe.2c0000.0.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 5.2.vlc.exe.2c0000.0.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 5.0.vlc.exe.2c0000.0.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 5.0.vlc.exe.2c0000.0.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 10.2.vlc.exe.610000.0.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 10.2.vlc.exe.610000.0.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 10.0.vlc.exe.610000.0.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 10.0.vlc.exe.610000.0.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 11.2.vlc.exe.330000.0.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 11.2.vlc.exe.330000.0.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 11.0.vlc.exe.330000.0.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 11.0.vlc.exe.330000.0.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 13.0.vlc.exe.6c0000.0.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 13.0.vlc.exe.6c0000.0.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: 13.2.vlc.exe.6c0000.1.unpack, OfPJiuVcDmcms67iZS/IJEQ27AYxrQu6q8jQX.csHigh entropy of concatenated method names: '.ctor', 'IJEAQ27Yx', 'wQuV6q8jQ', 'ipfqPJiuc', 'Dispose', 'vmcYms67i', 'B0vwQQDIuqKx4BDwLK', 'gc4ygQNVrCsLbbwb3h', 'Jb82otdxrIq85WnaGj', 'H1nMEOw2nTDJGJwurX'
                Source: 13.2.vlc.exe.6c0000.1.unpack, N6jK3lnxCEviDBrFrl/Aj1MjKiGeAM8T3kXE9.csHigh entropy of concatenated method names: 'kkXuE9m6j', 'W3l3xCEvi', 'vBrFFrllp', 'OE3PJX1eH', 'LUWCkq4eg', 'zj9wtQsWx', '.ctor', '.cctor', 'J8KxL8vk4josDwLPjB', 'zEeB7okDlat0rdN3v8'
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to dropped file
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLANJump to behavior
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe\:Zone.Identifier:$DATAJump to behavior
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlcJump to behavior
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlcJump to behavior
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX

                Malware Analysis System Evasion:

                barindex
                Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.263873601.00000000030A1000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.314083597.000000000265C000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeWindow / User API: threadDelayed 2456
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeWindow / User API: threadDelayed 7357
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeWindow / User API: threadDelayed 1281
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeWindow / User API: threadDelayed 8562
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe TID: 3984Thread sleep count: 64 > 30
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe TID: 4120Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe TID: 6304Thread sleep time: -19369081277395017s >= -30000s
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe TID: 6308Thread sleep count: 2456 > 30
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe TID: 6308Thread sleep count: 7357 > 30
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 1380Thread sleep count: 63 > 30
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 1488Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6272Thread sleep count: 44 > 30
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6808Thread sleep time: -22136092888451448s >= -30000s
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6812Thread sleep count: 1281 > 30
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6812Thread sleep count: 8562 > 30
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
                Source: vlc.exe, 00000005.00000002.314602524.00000000026D6000.00000004.00000001.sdmpBinary or memory string: vmware
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess information queried: ProcessInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeCode function: 2_2_0642A420 LdrInitializeThunk,
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess token adjusted: Debug
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess token adjusted: Debug
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess token adjusted: Debug
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess token adjusted: Debug
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeMemory allocated: page read and write | page guard

                HIPS / PFW / Operating System Protection Evasion:

                barindex
                Injects a PE file into a foreign processesShow sources
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeMemory written: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe base: 400000 value starts with: 4D5A
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeMemory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe base: 400000 value starts with: 4D5A
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505440811.0000000001430000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.504906741.0000000001620000.00000002.00000001.sdmpBinary or memory string: Program Manager
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505440811.0000000001430000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.504906741.0000000001620000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505440811.0000000001430000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.504906741.0000000001620000.00000002.00000001.sdmpBinary or memory string: Progman
                Source: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505440811.0000000001430000.00000002.00000001.sdmp, vlc.exe, 0000000D.00000002.504906741.0000000001620000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 5_2_0696A540 GetUserNameA,
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                Stealing of Sensitive Information:

                barindex
                Yara detected AgentTeslaShow sources
                Source: Yara matchFile source: 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.263990752.0000000003129000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.500003272.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.505873536.0000000002B55000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.264115098.00000000040A1000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.314707894.00000000026E8000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000D.00000002.500027054.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.315101943.00000000035C1000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.313468004.00000000025C1000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: vlc.exe PID: 6400, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe PID: 3148, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: vlc.exe PID: 4120, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe PID: 2844, type: MEMORY
                Source: Yara matchFile source: 13.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.400000.0.unpack, type: UNPACKEDPE
                Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                Tries to harvest and steal browser information (history, passwords, etc)Show sources
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                Tries to harvest and steal ftp login credentialsShow sources
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                Tries to steal Mail credentials (via file access)Show sources
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                Source: Yara matchFile source: 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.505873536.0000000002B55000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: vlc.exe PID: 6400, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe PID: 2844, type: MEMORY

                Remote Access Functionality:

                barindex
                Yara detected AgentTeslaShow sources
                Source: Yara matchFile source: 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.263990752.0000000003129000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.500003272.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.505873536.0000000002B55000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.264115098.00000000040A1000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.314707894.00000000026E8000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000D.00000002.500027054.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.315101943.00000000035C1000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.313468004.00000000025C1000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: vlc.exe PID: 6400, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe PID: 3148, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: vlc.exe PID: 4120, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe PID: 2844, type: MEMORY
                Source: Yara matchFile source: 13.2.vlc.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.400000.0.unpack, type: UNPACKEDPE

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                Valid AccountsWindows Management Instrumentation221Registry Run Keys / Startup Folder11Process Injection112Disable or Modify Tools1OS Credential Dumping2Account Discovery1Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel12Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsRegistry Run Keys / Startup Folder11Deobfuscate/Decode Files or Information1Credentials in Registry1File and Directory Discovery1Remote Desktop ProtocolData from Local System2Exfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information2Security Account ManagerSystem Information Discovery124SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Software Packing3NTDSQuery Registry1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptMasquerading1LSA SecretsSecurity Software Discovery321SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                Replication Through Removable MediaLaunchdRc.commonRc.commonVirtualization/Sandbox Evasion14Cached Domain CredentialsVirtualization/Sandbox Evasion14VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                External Remote ServicesScheduled TaskStartup ItemsStartup ItemsProcess Injection112DCSyncProcess Discovery2Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemApplication Window Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadowSystem Owner/User Discovery1Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork SniffingRemote System Discovery1Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
                Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronRight-to-Left OverrideInput CaptureSystem Network Configuration Discovery1Replication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 323824 Sample: SecuriteInfo.com.Trojan.PWS... Startdate: 27/11/2020 Architecture: WINDOWS Score: 100 29 mail.baharanvilla.ir 2->29 31 cdn.onenote.net 2->31 33 baharanvilla.ir 2->33 49 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->49 51 Found malware configuration 2->51 53 Multi AV Scanner detection for dropped file 2->53 55 9 other signatures 2->55 7 SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe 1 6 2->7         started        11 vlc.exe 3 2->11         started        13 vlc.exe 2 2->13         started        signatures3 process4 file5 23 C:\Users\user\AppData\Roaming\...\vlc.exe, PE32 7->23 dropped 25 C:\Users\user\...\vlc.exe:Zone.Identifier, ASCII 7->25 dropped 27 SecuriteInfo.com.T...29618.24275.exe.log, ASCII 7->27 dropped 57 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->57 59 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->59 61 Injects a PE file into a foreign processes 7->61 15 SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe 15 2 7->15         started        19 vlc.exe 2 11->19         started        21 vlc.exe 11->21         started        signatures6 process7 dnsIp8 35 elb097307-934924932.us-east-1.elb.amazonaws.com 54.225.169.28, 443, 49738 AMAZON-AESUS United States 15->35 37 nagano-19599.herokussl.com 15->37 39 api.ipify.org 15->39 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->41 43 Tries to steal Mail credentials (via file access) 15->43 45 Tries to harvest and steal ftp login credentials 15->45 47 Tries to harvest and steal browser information (history, passwords, etc) 15->47 signatures9

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe31%VirustotalBrowse
                SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe38%ReversingLabsByteCode-MSIL.Infostealer.Maslog
                SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe100%Joe Sandbox ML

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe100%Joe Sandbox ML
                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe38%ReversingLabsByteCode-MSIL.Infostealer.Maslog

                Unpacked PE Files

                SourceDetectionScannerLabelLinkDownload
                2.2.SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                13.2.vlc.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                Domains

                SourceDetectionScannerLabelLink
                baharanvilla.ir2%VirustotalBrowse
                cdn.onenote.net1%VirustotalBrowse

                URLs

                SourceDetectionScannerLabelLink
                http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                http://mail.baharanvilla.ir0%Avira URL Cloudsafe
                http://www.fontbureau.comd90%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/yq0%Avira URL Cloudsafe
                http://www.fontbureau.comcom/0%Avira URL Cloudsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.typography.net-u0%Avira URL Cloudsafe
                http://www.typography.netw~0%Avira URL Cloudsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                http://www.fontbureau.comnap/0%Avira URL Cloudsafe
                http://www.urwpp.deFT0%Avira URL Cloudsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                http://www.galapagosdesign.com/0%URL Reputationsafe
                http://www.galapagosdesign.com/0%URL Reputationsafe
                http://www.galapagosdesign.com/0%URL Reputationsafe
                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/R0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/Y0t00%Avira URL Cloudsafe
                http://www.typography.netlique0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/1q0%Avira URL Cloudsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://www.sakkal.com00%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/t0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/t0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/t0%URL Reputationsafe
                http://www.fontbureau.comcomF0%Avira URL Cloudsafe
                http://www.galapagosdesign.com/Tq9sp0%Avira URL Cloudsafe
                http://www.typography.nett0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/:qWs0%Avira URL Cloudsafe
                http://www.sandoll.co.krrsy0%Avira URL Cloudsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/Cq0%Avira URL Cloudsafe
                http://www.typography.netief0%Avira URL Cloudsafe
                https://6Myp18QaIbJyfOWJxc.com0%Avira URL Cloudsafe
                http://www.fontbureau.comueedoq$s$0%Avira URL Cloudsafe
                http://www.carterandcone.comTCQ0%Avira URL Cloudsafe
                http://www.carterandcone.com10%Avira URL Cloudsafe
                http://lMzSbX.com0%Avira URL Cloudsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/-ca(qes0%Avira URL Cloudsafe
                http://www.fontbureau.commyq0%Avira URL Cloudsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.carterandcone.com0%URL Reputationsafe
                http://www.carterandcone.com0%URL Reputationsafe
                http://www.carterandcone.com0%URL Reputationsafe
                http://www.typography.netK~0%Avira URL Cloudsafe
                http://www.fontbureau.comT.TTF0%Avira URL Cloudsafe
                http://www.carterandcone.comrl0%Avira URL Cloudsafe
                https://api.ipify.orgGETMozilla/5.00%URL Reputationsafe
                https://api.ipify.orgGETMozilla/5.00%URL Reputationsafe
                https://api.ipify.orgGETMozilla/5.00%URL Reputationsafe
                http://schemas.microso0%Avira URL Cloudsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://fontfabrik.com0%URL Reputationsafe
                http://fontfabrik.com0%URL Reputationsafe
                http://fontfabrik.com0%URL Reputationsafe
                http://www.fontbureau.comB.TTF0%Avira URL Cloudsafe
                http://www.galapagosdesign.com/staff/dennis.htmI0%Avira URL Cloudsafe
                http://www.fonts.comp0%Avira URL Cloudsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.urwpp.de0%URL Reputationsafe
                http://www.urwpp.de0%URL Reputationsafe
                http://www.urwpp.de0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                http://www.galapagosdesign.com/O0%Avira URL Cloudsafe
                http://DynDns.comDynDNS0%URL Reputationsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                elb097307-934924932.us-east-1.elb.amazonaws.com
                		54.225.169.28
                		truefalse
                  		high
                  baharanvilla.ir
                  		185.165.40.194
                  		truetrueunknown
                  api.ipify.org
                  		unknown
                  		unknownfalse
                    		high
                    mail.baharanvilla.ir
                    		unknown
                    		unknowntrue
                      		unknown
                      cdn.onenote.net
                      		unknown
                      		unknowntrueunknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://127.0.0.1:HTTP/1.1SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, vlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://www.fontbureau.com/designersL6SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.244267564.0000000005E2E000.00000004.00000001.sdmpfalse
                        		high
                        http://mail.baharanvilla.irSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.507519954.0000000002DBC000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.fontbureau.comd9SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239403264.0000000005E14000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.jiyu-kobo.co.jp/yqSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.235672179.0000000005E14000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.fontbureau.comcom/SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238679080.0000000005E14000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.fontbureau.com/designersvlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                          		high
                          http://www.sajatypeworks.comSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.founder.com.cn/cn/cTheSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designersersSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238939245.0000000005E2E000.00000004.00000001.sdmpfalse
                            		high
                            http://www.typography.net-uSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232850879.0000000005E0B000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.com/SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238595635.0000000005E14000.00000004.00000001.sdmpfalse
                              		high
                              http://www.typography.netw~SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232850879.0000000005E0B000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		low
                              http://www.galapagosdesign.com/DPleaseSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.comnap/SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238565181.0000000005E14000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.urwpp.deFTSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240089803.0000000005DF2000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.urwpp.deDPleaseSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.zhongyicts.com.cnSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmpfalse
                                		high
                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.263990752.0000000003129000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.500003272.0000000000402000.00000040.00000001.sdmp, vlc.exe, 00000005.00000002.314707894.00000000026E8000.00000004.00000001.sdmp, vlc.exe, 0000000D.00000002.500027054.0000000000402000.00000040.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.galapagosdesign.com/SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240839268.0000000005E12000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240891546.0000000005E12000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240847379.0000000005DFB000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, vlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.jiyu-kobo.co.jp/RSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.236395168.0000000005E14000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.jiyu-kobo.co.jp/Y0t0SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.235672179.0000000005E14000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.typography.netliqueSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232879628.0000000005E0B000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.jiyu-kobo.co.jp/1qSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237159352.0000000005E14000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.carterandcone.comlSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.sakkal.com0SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237106452.0000000005E36000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.fontbureau.com/designers/frere-jones.htmlSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.fontbureau.com/designers96-sSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239940201.0000000005E2E000.00000004.00000001.sdmpfalse
                                    		high
                                    http://www.jiyu-kobo.co.jp/tSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237159352.0000000005E14000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.comcomFSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239333550.0000000005E14000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.galapagosdesign.com/Tq9spSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240839268.0000000005E12000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.typography.nettSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232879628.0000000005E0B000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.jiyu-kobo.co.jp/:qWsSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237159352.0000000005E14000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.sandoll.co.krrsySecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.233475482.0000000005DFA000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.fontbureau.com/designersGSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                      		high
                                      http://www.fontbureau.com/designers/?SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                        		high
                                        http://www.founder.com.cn/cn/bTheSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.com/designers?SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                          		high
                                          http://www.jiyu-kobo.co.jp/CqSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.236224002.0000000005E14000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.typography.netiefSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232879628.0000000005E0B000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://6Myp18QaIbJyfOWJxc.comSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505873536.0000000002B55000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.507621145.0000000002DC9000.00000004.00000001.sdmptrue
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.fontbureau.comueedoq$s$SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238874107.0000000005E14000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		low
                                          http://www.carterandcone.comTCQSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.234655964.0000000005DF2000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.carterandcone.com1SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.234598135.0000000005DF2000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://lMzSbX.comvlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.tiro.comvlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.jiyu-kobo.co.jp/-ca(qesSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237159352.0000000005E14000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.fontbureau.commyqSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239059251.0000000005E14000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.goodfont.co.krSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.carterandcone.comSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.234655964.0000000005DF2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.typography.netK~SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232850879.0000000005E0B000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		low
                                          http://www.fontbureau.com/designersUSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238855975.0000000005E2E000.00000004.00000001.sdmpfalse
                                            		high
                                            http://www.fontbureau.comT.TTFSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240319258.0000000005E13000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.carterandcone.comrlSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.234598135.0000000005DF2000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://api.ipify.orgGETMozilla/5.0vlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            http://schemas.microsovlc.exefalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.typography.netDSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.fontbureau.com/designers#6GsSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239721532.0000000005E2E000.00000004.00000001.sdmpfalse
                                              		high
                                              http://www.galapagosdesign.com/staff/dennis.htmSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.241174877.0000000005DF2000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              https://api.ipify.orgSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmpfalse
                                                		high
                                                http://fontfabrik.comSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.fontbureau.comB.TTFSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239451545.0000000005E14000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.galapagosdesign.com/staff/dennis.htmISecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.260481176.0000000005DF0000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.fonts.compSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232604882.0000000005E0B000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.fonts.comSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                                  		high
                                                  http://www.sandoll.co.krSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.urwpp.deSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240089803.0000000005DF2000.00000004.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.sakkal.comSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://api.ipify.org/SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmpfalse
                                                    		high
                                                    http://www.apache.org/licenses/LICENSE-2.0SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                                      		high
                                                      http://www.fontbureau.comSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238626941.0000000005E14000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                                        		high
                                                        http://www.galapagosdesign.com/OSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240847379.0000000005DFB000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://DynDns.comDynDNSvlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.fontbureau.comFSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239207194.0000000005E14000.00000004.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.jiyu-kobo.co.jp/fqSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.236224002.0000000005E14000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.jiyu-kobo.co.jp/tTq9spSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237950566.0000000005E14000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.fontbureau.comCqSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.240319258.0000000005E13000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.fontbureau.comce9SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.244250202.0000000005E12000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.fontbureau.com/designerss7SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238577684.0000000005E2E000.00000004.00000001.sdmpfalse
                                                          		high
                                                          http://baharanvilla.irSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.507519954.0000000002DBC000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.typography.netrzSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.233119604.0000000005E0B000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.jiyu-kobo.co.jp/jp/SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.236224002.0000000005E14000.00000004.00000001.sdmpfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://www.fontbureau.comaSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.244296179.0000000005E12000.00000004.00000001.sdmpfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://en.wikipSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.232384565.0000000005E13000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.fontbureau.comdSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239451545.0000000005E14000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238986582.0000000005E14000.00000004.00000001.sdmpfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://www.fontbureau.com/designers/cabarga.htmlNSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                                            		high
                                                            http://www.founder.com.cn/cnSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://api.telegram.org/bot%telegramapi%/SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.263990752.0000000003129000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.500003272.0000000000402000.00000040.00000001.sdmp, vlc.exe, 00000005.00000002.314707894.00000000026E8000.00000004.00000001.sdmp, vlc.exe, 0000000D.00000002.500027054.0000000000402000.00000040.00000001.sdmpfalse
                                                              		high
                                                              http://www.jiyu-kobo.co.jp/SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.237159352.0000000005E14000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://www.fontbureau.comionoSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239059251.0000000005E14000.00000004.00000001.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://www.fontbureau.comoSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239451545.0000000005E14000.00000004.00000001.sdmpfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://www.fontbureau.com/designers8SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000002.270119765.0000000007102000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239224806.0000000005E2E000.00000004.00000001.sdmp, vlc.exe, 00000005.00000002.320148424.0000000005680000.00000002.00000001.sdmp, vlc.exe, 0000000A.00000002.323690888.00000000059E0000.00000002.00000001.sdmpfalse
                                                                		high
                                                                http://www.fontbureau.comd?SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239263737.0000000005E14000.00000004.00000001.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://secure.comodo.com/CPS0SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505816927.0000000002B3B000.00000004.00000001.sdmpfalse
                                                                  		high
                                                                  http://www.fontbureau.com/designers/SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.238553956.0000000005E2E000.00000004.00000001.sdmpfalse
                                                                    		high
                                                                    https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------xSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, vlc.exe, 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmpfalse
                                                                      		high
                                                                      http://www.fontbureau.comsiefSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.239550906.0000000005E14000.00000004.00000001.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      http://www.jiyu-kobo.co.jp/jp/yqSecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe, 00000000.00000003.236224002.0000000005E14000.00000004.00000001.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown

                                                                      Contacted IPs

                                                                      • No. of IPs < 25%
                                                                      • 25% < No. of IPs < 50%
                                                                      • 50% < No. of IPs < 75%
                                                                      • 75% < No. of IPs

                                                                      Public

                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                      54.225.169.28
                                                                      		unknownUnited States
                                                                      		14618AMAZON-AESUSfalse

                                                                      General Information

                                                                      Joe Sandbox Version:31.0.0 Red Diamond
                                                                      Analysis ID:323824
                                                                      Start date:27.11.2020
                                                                      Start time:15:50:11
                                                                      Joe Sandbox Product:CloudBasic
                                                                      Overall analysis duration:0h 12m 57s
                                                                      Hypervisor based Inspection enabled:false
                                                                      Report type:light
                                                                      Sample file name:SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.28577 (renamed file extension from 28577 to exe)
                                                                      Cookbook file name:default.jbs
                                                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                      Number of analysed new started processes analysed:20
                                                                      Number of new started drivers analysed:0
                                                                      Number of existing processes analysed:0
                                                                      Number of existing drivers analysed:0
                                                                      Number of injected processes analysed:0
                                                                      Technologies:
                                                                      • HCA enabled
                                                                      • EGA enabled
                                                                      • HDC enabled
                                                                      • AMSI enabled
                                                                      Analysis Mode:default
                                                                      Analysis stop reason:Timeout
                                                                      Detection:MAL
                                                                      Classification:mal100.troj.spyw.evad.winEXE@9/4@5/1
                                                                      EGA Information:Failed
                                                                      HDC Information:Failed
                                                                      HCA Information:
                                                                      • Successful, ratio: 99%
                                                                      • Number of executed functions: 0
                                                                      • Number of non-executed functions: 0
                                                                      Cookbook Comments:
                                                                      • Adjust boot time
                                                                      • Enable AMSI
                                                                      Warnings:
                                                                      Show All
                                                                      • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, UsoClient.exe
                                                                      • Excluded IPs from analysis (whitelisted): 52.255.188.83, 13.64.90.137, 95.101.184.67, 51.11.168.160, 2.20.142.210, 2.20.142.209, 20.54.26.129, 92.122.213.247, 92.122.213.194, 184.24.28.12, 184.24.7.187
                                                                      • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, e15275.g.akamaiedge.net, arc.msn.com, cdn.onenote.net.edgekey.net, wildcard.weather.microsoft.com.edgekey.net, audownload.windowsupdate.nsatc.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, ris-prod.trafficmanager.net, tile-service.weather.microsoft.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, e1553.dspg.akamaiedge.net
                                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                      • Report size getting too big, too many NtQueryValueKey calls found.

                                                                      Simulations

                                                                      Behavior and APIs

                                                                      TimeTypeDescription
                                                                      15:51:26AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run vlc "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"
                                                                      15:51:35AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run vlc "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"
                                                                      15:51:44API Interceptor653x Sleep call for process: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe modified
                                                                      15:52:08API Interceptor492x Sleep call for process: vlc.exe modified

                                                                      Joe Sandbox View / Context

                                                                      IPs

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      54.225.169.285C.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      Bc.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      Ejgvvuwuu8.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      Machine drawing.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      26VT73zxnr.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      SecuriteInfo.com.Trojan.Inject4.5025.20792.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      Jeveeagp4.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      gunzipped.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      zU4HDC7vYA.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      InquirySW23020KT.com.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      Commercial Invoice73802,PDF.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      Purchase Order.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      PO-0561.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      SecuriteInfo.com.Trojan.PackedNET.424.9536.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      SecuriteInfo.com.BehavesLike.Win32.Generic.dc.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      update.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/?format=xml
                                                                      Purchase Order.scr.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      PO #154469-70.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      QN27UyUjZ5.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/
                                                                      RFQ & SAMPLES PRODUCTS 9-1009-GRGS 403.2MT STR20.pdf.exeGet hashmaliciousBrowse
                                                                      • api.ipify.org/

                                                                      Domains

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      elb097307-934924932.us-east-1.elb.amazonaws.comSecuriteInfo.com.Trojan.MulDrop15.61981.23282.exeGet hashmaliciousBrowse
                                                                      • 54.235.142.93
                                                                      ORDER.exeGet hashmaliciousBrowse
                                                                      • 54.243.164.148
                                                                      swift copy.exeGet hashmaliciousBrowse
                                                                      • 23.21.42.25
                                                                      26-11-20_Dhl_Signed_document-pdf.exeGet hashmaliciousBrowse
                                                                      • 54.225.220.115
                                                                      Arrivalnotice2020pdf.exeGet hashmaliciousBrowse
                                                                      • 174.129.214.20
                                                                      lxpo.exeGet hashmaliciousBrowse
                                                                      • 54.204.14.42
                                                                      guy1.exeGet hashmaliciousBrowse
                                                                      • 54.225.66.103
                                                                      guy2.exeGet hashmaliciousBrowse
                                                                      • 54.243.161.145
                                                                      PO_0012009.xlsxGet hashmaliciousBrowse
                                                                      • 23.21.252.4
                                                                      5C.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      INV-6367-20_pdf.exeGet hashmaliciousBrowse
                                                                      • 54.225.66.103
                                                                      #A06578987.xlsmGet hashmaliciousBrowse
                                                                      • 54.204.14.42
                                                                      SecuriteInfo.com.Variant.Bulz.233365.3916.exeGet hashmaliciousBrowse
                                                                      • 23.21.252.4
                                                                      https://sugar-stirring-mockingbird.glitch.me/#comp@hansi.atGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      INVOICE.xlsxGet hashmaliciousBrowse
                                                                      • 54.204.14.42
                                                                      PR24869408-V2.PDF.exeGet hashmaliciousBrowse
                                                                      • 174.129.214.20
                                                                      Inquiry_pdf.exeGet hashmaliciousBrowse
                                                                      • 23.21.42.25
                                                                      98650107.pdf.exeGet hashmaliciousBrowse
                                                                      • 23.21.42.25
                                                                      #U00d6deme Onay#U0131 Makbuzu.exeGet hashmaliciousBrowse
                                                                      • 174.129.214.20
                                                                      1125_56873981.docGet hashmaliciousBrowse
                                                                      • 54.243.161.145
                                                                      baharanvilla.irSecuriteInfo.com.Variant.Bulz.233365.3916.exeGet hashmaliciousBrowse
                                                                      • 185.165.40.194
                                                                      BQoFEXaNOEtJ9dC.exeGet hashmaliciousBrowse
                                                                      • 185.165.40.194

                                                                      ASN

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      AMAZON-AESUSSecuriteInfo.com.Trojan.MulDrop15.61981.23282.exeGet hashmaliciousBrowse
                                                                      • 54.235.142.93
                                                                      ORDER.exeGet hashmaliciousBrowse
                                                                      • 54.243.164.148
                                                                      swift copy.exeGet hashmaliciousBrowse
                                                                      • 23.21.42.25
                                                                      26-11-20_Dhl_Signed_document-pdf.exeGet hashmaliciousBrowse
                                                                      • 54.225.220.115
                                                                      Direct Deposit.xlsxGet hashmaliciousBrowse
                                                                      • 34.231.129.212
                                                                      Direct Deposit.xlsxGet hashmaliciousBrowse
                                                                      • 52.205.236.122
                                                                      https://is.gd/NLY8SbGet hashmaliciousBrowse
                                                                      • 35.174.78.146
                                                                      Arrivalnotice2020pdf.exeGet hashmaliciousBrowse
                                                                      • 174.129.214.20
                                                                      guy1.exeGet hashmaliciousBrowse
                                                                      • 54.225.66.103
                                                                      guy2.exeGet hashmaliciousBrowse
                                                                      • 54.243.161.145
                                                                      https://34.75.2o2.lol/XYWNc0aW9uPWwNsaWNrJngVybD1ovndHRwnczovL3NleY3wVyZWQtbG9naW4ubmV0nL3BhZ2VzLzQyY2FkNTJhZmU3YSZyZWNpcGllbnRfaWQ9NzM2OTg3ODg4JmNhbXBhaWduX3J1bl9pZD0zOTM3OTczGet hashmaliciousBrowse
                                                                      • 3.215.226.95
                                                                      https://bit.do/fLpprGet hashmaliciousBrowse
                                                                      • 54.83.52.76
                                                                      PO_0012009.xlsxGet hashmaliciousBrowse
                                                                      • 23.21.252.4
                                                                      https://webnavigator.co/?adprovider=AppFocus1&source=d-cp11560482685&group=cg60&device=c&keyword=&creative=477646941053&adposition=none&placement=www.123homeschool4me.com&target=segment_be_a_7802457135858218830&sl=&caid=11560482685&gw=1&test=%3a%2f%2fmailGet hashmaliciousBrowse
                                                                      • 54.90.26.145
                                                                      https://m365.eu.vadesecure.com/safeproxy/v4?f=xQsVwKRZoQHMcJWN90zqnir6G6pZJkmZJBUJoNEfoN5w0NIk94-OeCH1NldcAqKsz75KalR9dIZlPCJr1Ux0xQ&i=dKwbScfh0hAXC0Inkkq0sM5FeXPK9I7Ny4D2nAPOiEibKJwP2etJDqX8WzAoEu0mklzE6wT-r8I8OtTRdIg8Sg&k=EPqM&r=_vxI1MPLJP9RjHYc6dmEH2aQYLnm7iSEcU9gx_WNg2_vrJo8MeAqNzNCqHX9DNrQ&s=dbc75c7ed54466f34eeae3fd3b1612b20fb815efc99933570f78acd79467623c&u=https%3A%2F%2Femail.utest.com%2Fls%2Fclick%3Fupn%3DlGjzeq3i4yih7CYyWDD2uGWEioaO303Ya1CTzgGY6ZFHmgV-2FF-2FEWXdAYvLiLIvET2r-2BfuQ5qIL56xFMZkA-2F-2BXKhuWb2hSemZwMxFmG0rDjjP9tlrcROzWmQSAh2kMQamb79I1cx4-2Fvjhww3n8oZQi-2FnOhlQdbGdNxKrX28q7P-2FPufa0AAvr-2FvNJcD-2FrxpMHjDG9dPJU0WEGqi12uVZQLCz-2BjYAJF5yCzK-2FjUezEn2d6sv-2BTETl96ejjfG9yQ2VbdWqGp_snpiKdUCY2bDrEnMsWMAnz6f3HkWPd0oUIj3WsKz0V4NahNEm-2BJ9rDW2-2Fib8wsclxoRuHsrv-2B0aoCVw0ftXwGZJTPgQ4k6DZXQjAqFeejOYe-2FRbaSc1Yf5Xj5PUa6lKqmFYNWSkevePONwyMaBGxV4NDGtgMbAc7jyOEWYDUniHPiY87Lpiw631423FED14OvXIfrL7S45QvDvK6-2Fc04r-2B65lMxyCebYSr-2FOr4bCpGQ-3DGet hashmaliciousBrowse
                                                                      • 52.202.11.207
                                                                      https://webmail-re5rere.web.app/?emailtoken=test@test.com&domain=test.comGet hashmaliciousBrowse
                                                                      • 34.236.142.3
                                                                      5C.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      INV-6367-20_pdf.exeGet hashmaliciousBrowse
                                                                      • 54.225.66.103
                                                                      #A06578987.xlsmGet hashmaliciousBrowse
                                                                      • 54.204.14.42
                                                                      https://email.utest.com/ls/click?upn=kHi9kJ2VFJGMl00Uc0lXdd7WKRMGsOIU4g4ei1d-2FX5m1QA-2FrT8Vl5L3Fk3cMytK6G9se1iMMnmCZDn1xIdrYiQ1p-2FwcQpvha0Cl5oPF0v81y5hgAsim7OqaA63T8LZn1UUJIEgydRUHiWwDj8GYDCxqGnV0O0rI4O7I6kSKWwA2QN6GRUB5jtLYkPnKAtjOoUgEhfuSimn9pHS78TURJ3gh4c37fJ5SLcFsdSMlL5cSNM599TAmyU83RYL5vT6LiS59Z_K8t8bbLaByOBk98eoL7OiHjGcOStuW9cK4Z47GjL3LOg6J63-2FMkWRpNoPmcLIu18HCMEgODcyx-2FUvVhPVIvmHjzJiqJBCjoeBbWoJaKrxsvgnkh140XYi8oSb4fB3DPwhOq9ho1ZQ40V7Ij7E76nndroD8i7Zx6K9k23tLqOPU-2BI4uv4B0Gy5ZNEnpZd7wg2RXwXNiQ76annNuw-2BlzoA5-2FGihgJE5sZwqDaPnA1XR7c-3DGet hashmaliciousBrowse
                                                                      • 52.202.11.207

                                                                      JA3 Fingerprints

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      3b5074b1b5d032e5620f69f9f700ff0ePurchase Order.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      ORDER.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      Mixtec New Order And Price List Requsting Form_pdf.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      swift copy.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      26-11-20_Dhl_Signed_document-pdf.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      Arrivalnotice2020pdf.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      SecuriteInfo.com.Mal.Generic-S.26042.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      guy1.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      guy2.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      Exodus.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      INV-6367-20_pdf.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      #A06578987.xlsmGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      Order 51897.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      PR24869408-V2.PDF.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      98650107.pdf.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      #U00d6deme Onay#U0131 Makbuzu.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      Izezma64.dllGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      fuxenm32.dllGet hashmaliciousBrowse
                                                                      • 54.225.169.28
                                                                      http://ancien-site-joomla.fr/build2.exeGet hashmaliciousBrowse
                                                                      • 54.225.169.28

                                                                      Dropped Files

                                                                      No context

                                                                      Created / dropped Files

                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe.log
                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:modified
                                                                      Size (bytes):1391
                                                                      Entropy (8bit):5.344111348947579
                                                                      Encrypted:false
                                                                      SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4xLE4qE4W:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzh
                                                                      MD5:E87C60A24438CC611338EA5ACB433A0A
                                                                      SHA1:E0C6A7D5CFE32BB2178E71DEE79971A51697B7DD
                                                                      SHA-256:80DAB47D7A9E233A692D10ACAF5793E34911836D36DB2E11BB7C5D42DE39782A
                                                                      SHA-512:3DBD6773153DC9D05558ED491A92C9B4B72D594263D7BD2D06BDDCF09BE55477D35041145219A5E9A46B38575E5B60DA91C6870B2CA29A83388695AD389B8EBF
                                                                      Malicious:true
                                                                      Reputation:moderate, very likely benign file
                                                                      Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vlc.exe.log
                                                                      Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):1391
                                                                      Entropy (8bit):5.344111348947579
                                                                      Encrypted:false
                                                                      SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4xLE4qE4W:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzh
                                                                      MD5:E87C60A24438CC611338EA5ACB433A0A
                                                                      SHA1:E0C6A7D5CFE32BB2178E71DEE79971A51697B7DD
                                                                      SHA-256:80DAB47D7A9E233A692D10ACAF5793E34911836D36DB2E11BB7C5D42DE39782A
                                                                      SHA-512:3DBD6773153DC9D05558ED491A92C9B4B72D594263D7BD2D06BDDCF09BE55477D35041145219A5E9A46B38575E5B60DA91C6870B2CA29A83388695AD389B8EBF
                                                                      Malicious:false
                                                                      Reputation:moderate, very likely benign file
                                                                      Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Category:dropped
                                                                      Size (bytes):248832
                                                                      Entropy (8bit):7.944818129285475
                                                                      Encrypted:false
                                                                      SSDEEP:6144:tUEq9SvnCIlBvQ1Q2Yc08zqgRqYKZqj7buFP24oeu8:u2n/B4+XyRqRgOBoez
                                                                      MD5:224E779FF4D39CE90878AE3E630197E7
                                                                      SHA1:E248C7182CBFB6679AB327BBE77A9EB469121AC8
                                                                      SHA-256:92D9B1922BEBBB60F7CA75EB99220F92BBDF687AF32A4A966EC90FD562DFE96E
                                                                      SHA-512:BC99E47A6BD073C19DEDB989B4CB9557367C40C120BEB1769FDE5C9FF828B61FB32132E53727F0CA7852236222937F5A5048267E2886AE1AF1D6BE7083D843C5
                                                                      Malicious:true
                                                                      Antivirus:
                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                      • Antivirus: ReversingLabs, Detection: 38%
                                                                      Reputation:low
                                                                      Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b)._................................. ........@.. ....................... ............@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........1...5......b....f...o...........................................0..y........(....8....8........E....8...!...I...83....(.... .....:....& ....8.....(.... .....9....&8.....(.... ....8....*.(....8........0..-....... ........8........E........".......................8....*s...... ....(....9....&8......o....8\.........(....r...p................(.......(..................o.......o....t....}.... ....8U...8W... ....(....9A...& ....86... ...... ....8%....(.... ....(....9....&8
                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe:Zone.Identifier
                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):26
                                                                      Entropy (8bit):3.95006375643621
                                                                      Encrypted:false
                                                                      SSDEEP:3:ggPYV:rPYV
                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                      Malicious:true
                                                                      Reputation:high, very likely benign file
                                                                      Preview: [ZoneTransfer]....ZoneId=0

                                                                      Static File Info

                                                                      General

                                                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Entropy (8bit):7.944818129285475
                                                                      TrID:
                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                      • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                      • DOS Executable Generic (2002/1) 0.01%
                                                                      File name:SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                                                                      File size:248832
                                                                      MD5:224e779ff4d39ce90878ae3e630197e7
                                                                      SHA1:e248c7182cbfb6679ab327bbe77a9eb469121ac8
                                                                      SHA256:92d9b1922bebbb60f7ca75eb99220f92bbdf687af32a4a966ec90fd562dfe96e
                                                                      SHA512:bc99e47a6bd073c19dedb989b4cb9557367c40c120beb1769fde5c9ff828b61fb32132e53727f0ca7852236222937f5a5048267e2886ae1af1d6be7083d843c5
                                                                      SSDEEP:6144:tUEq9SvnCIlBvQ1Q2Yc08zqgRqYKZqj7buFP24oeu8:u2n/B4+XyRqRgOBoez
                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b)._................................. ........@.. ....................... ............@................................

                                                                      File Icon

                                                                      Icon Hash:00828e8e8686b000

                                                                      Static PE Info

                                                                      General

                                                                      Entrypoint:0x43d60e
                                                                      Entrypoint Section:.text
                                                                      Digitally signed:false
                                                                      Imagebase:0x400000
                                                                      Subsystem:windows gui
                                                                      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                                                                      DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                      Time Stamp:0x5FC02962 [Thu Nov 26 22:17:06 2020 UTC]
                                                                      TLS Callbacks:
                                                                      CLR (.Net) Version:v4.0.30319
                                                                      OS Version Major:4
                                                                      OS Version Minor:0
                                                                      File Version Major:4
                                                                      File Version Minor:0
                                                                      Subsystem Version Major:4
                                                                      Subsystem Version Minor:0
                                                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                      Entrypoint Preview

                                                                      Instruction
                                                                      jmp dword ptr [00402000h]
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al

                                                                      Data Directories

                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x3d5c00x4b.text
                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x3e0000xf80.rsrc
                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x400000xc.reloc
                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                      Sections

                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                      .text0x20000x3b6140x3b800False0.970099954044data7.96339396764IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                      .rsrc0x3e0000xf800x1000False0.387939453125data5.01100872549IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .reloc0x400000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                      Resources

                                                                      NameRVASizeTypeLanguageCountry
                                                                      RT_VERSION0x3e0a00x288data
                                                                      RT_MANIFEST0x3e3280xc55XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                      Imports

                                                                      DLLImport
                                                                      mscoree.dll_CorExeMain

                                                                      Version Infos

                                                                      DescriptionData
                                                                      Translation0x0000 0x04b0
                                                                      LegalCopyright
                                                                      Assembly Version1.0.0.0
                                                                      InternalNameNmsdmwkbi4.exe
                                                                      FileVersion1.0.0.0
                                                                      ProductNameVideoLAN
                                                                      ProductVersion1.0.0.0
                                                                      FileDescription
                                                                      OriginalFilenameNmsdmwkbi4.exe

                                                                      Network Behavior

                                                                      Snort IDS Alerts

                                                                      TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                      11/27/20-15:53:18.649493TCP2030171ET TROJAN AgentTesla Exfil Via SMTP49739587192.168.2.3185.165.40.194

                                                                      Network Port Distribution

                                                                      TCP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Nov 27, 2020 15:53:06.855217934 CET49738443192.168.2.354.225.169.28
                                                                      Nov 27, 2020 15:53:06.958154917 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:06.958297968 CET49738443192.168.2.354.225.169.28
                                                                      Nov 27, 2020 15:53:07.040256977 CET49738443192.168.2.354.225.169.28
                                                                      Nov 27, 2020 15:53:07.143094063 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:07.143204927 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:07.143223047 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:07.143238068 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:07.143254042 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:07.143377066 CET49738443192.168.2.354.225.169.28
                                                                      Nov 27, 2020 15:53:07.144329071 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:07.194504023 CET49738443192.168.2.354.225.169.28
                                                                      Nov 27, 2020 15:53:07.297736883 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:07.340001106 CET49738443192.168.2.354.225.169.28
                                                                      Nov 27, 2020 15:53:07.592104912 CET49738443192.168.2.354.225.169.28
                                                                      Nov 27, 2020 15:53:07.700268030 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:07.761272907 CET49738443192.168.2.354.225.169.28
                                                                      Nov 27, 2020 15:53:16.866636992 CET49738443192.168.2.354.225.169.28
                                                                      Nov 27, 2020 15:53:16.969662905 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:16.969686031 CET4434973854.225.169.28192.168.2.3
                                                                      Nov 27, 2020 15:53:16.969767094 CET49738443192.168.2.354.225.169.28
                                                                      Nov 27, 2020 15:53:16.969805002 CET49738443192.168.2.354.225.169.28

                                                                      UDP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Nov 27, 2020 15:51:05.509145975 CET6349253192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:05.536328077 CET53634928.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:06.215003014 CET6083153192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:06.242132902 CET53608318.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:14.740252018 CET6010053192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:14.767283916 CET53601008.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:15.785001040 CET5319553192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:15.811896086 CET53531958.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:16.461648941 CET5014153192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:16.496841908 CET53501418.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:17.609884977 CET5302353192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:17.637248993 CET53530238.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:18.685058117 CET4956353192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:18.713570118 CET53495638.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:19.470622063 CET5135253192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:19.506201029 CET53513528.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:20.140036106 CET5934953192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:20.167078018 CET53593498.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:21.098515034 CET5708453192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:21.125668049 CET53570848.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:23.169857979 CET5882353192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:23.205410004 CET53588238.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:30.008042097 CET5756853192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:30.044953108 CET53575688.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:32.894954920 CET5054053192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:32.921994925 CET53505408.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:53.416748047 CET5436653192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:53.453550100 CET53543668.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:51:59.918345928 CET5303453192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:51:59.961668015 CET53530348.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:52:08.657661915 CET5776253192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:52:08.684873104 CET53577628.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:52:14.514172077 CET5543553192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:52:14.551282883 CET53554358.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:52:46.668731928 CET5071353192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:52:46.695820093 CET53507138.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:52:48.720047951 CET5613253192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:52:48.757924080 CET53561328.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:53:06.645328045 CET5898753192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:53:06.672275066 CET53589878.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:53:06.695077896 CET5657953192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:53:06.730554104 CET53565798.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:53:16.879842043 CET6063353192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:53:16.915517092 CET53606338.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:53:16.969113111 CET6129253192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:53:17.004719019 CET53612928.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:53:19.707268953 CET6361953192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:53:19.707710981 CET6493853192.168.2.38.8.8.8
                                                                      Nov 27, 2020 15:53:19.744808912 CET53649388.8.8.8192.168.2.3
                                                                      Nov 27, 2020 15:53:19.746594906 CET53636198.8.8.8192.168.2.3

                                                                      DNS Queries

                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                      Nov 27, 2020 15:53:06.645328045 CET192.168.2.38.8.8.80x5cc5Standard query (0)api.ipify.orgA (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.695077896 CET192.168.2.38.8.8.80xca06Standard query (0)api.ipify.orgA (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:16.879842043 CET192.168.2.38.8.8.80x250cStandard query (0)mail.baharanvilla.irA (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:16.969113111 CET192.168.2.38.8.8.80xe898Standard query (0)mail.baharanvilla.irA (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:19.707710981 CET192.168.2.38.8.8.80x94cStandard query (0)cdn.onenote.netA (IP address)IN (0x0001)

                                                                      DNS Answers

                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                      Nov 27, 2020 15:53:06.672275066 CET8.8.8.8192.168.2.30x5cc5No error (0)api.ipify.orgnagano-19599.herokussl.comCNAME (Canonical name)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.672275066 CET8.8.8.8192.168.2.30x5cc5No error (0)nagano-19599.herokussl.comelb097307-934924932.us-east-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.672275066 CET8.8.8.8192.168.2.30x5cc5No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com54.225.169.28A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.672275066 CET8.8.8.8192.168.2.30x5cc5No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com54.243.164.148A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.672275066 CET8.8.8.8192.168.2.30x5cc5No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com50.19.252.36A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.672275066 CET8.8.8.8192.168.2.30x5cc5No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com23.21.126.66A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.672275066 CET8.8.8.8192.168.2.30x5cc5No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com54.235.142.93A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.672275066 CET8.8.8.8192.168.2.30x5cc5No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com174.129.214.20A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.672275066 CET8.8.8.8192.168.2.30x5cc5No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com23.21.252.4A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.672275066 CET8.8.8.8192.168.2.30x5cc5No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com54.243.161.145A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.730554104 CET8.8.8.8192.168.2.30xca06No error (0)api.ipify.orgnagano-19599.herokussl.comCNAME (Canonical name)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.730554104 CET8.8.8.8192.168.2.30xca06No error (0)nagano-19599.herokussl.comelb097307-934924932.us-east-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.730554104 CET8.8.8.8192.168.2.30xca06No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com54.225.169.28A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.730554104 CET8.8.8.8192.168.2.30xca06No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com54.243.164.148A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.730554104 CET8.8.8.8192.168.2.30xca06No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com50.19.252.36A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.730554104 CET8.8.8.8192.168.2.30xca06No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com23.21.126.66A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.730554104 CET8.8.8.8192.168.2.30xca06No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com54.235.142.93A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.730554104 CET8.8.8.8192.168.2.30xca06No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com174.129.214.20A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.730554104 CET8.8.8.8192.168.2.30xca06No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com23.21.252.4A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:06.730554104 CET8.8.8.8192.168.2.30xca06No error (0)elb097307-934924932.us-east-1.elb.amazonaws.com54.243.161.145A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:16.915517092 CET8.8.8.8192.168.2.30x250cNo error (0)mail.baharanvilla.irbaharanvilla.irCNAME (Canonical name)IN (0x0001)
                                                                      Nov 27, 2020 15:53:16.915517092 CET8.8.8.8192.168.2.30x250cNo error (0)baharanvilla.ir185.165.40.194A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:17.004719019 CET8.8.8.8192.168.2.30xe898No error (0)mail.baharanvilla.irbaharanvilla.irCNAME (Canonical name)IN (0x0001)
                                                                      Nov 27, 2020 15:53:17.004719019 CET8.8.8.8192.168.2.30xe898No error (0)baharanvilla.ir185.165.40.194A (IP address)IN (0x0001)
                                                                      Nov 27, 2020 15:53:19.744808912 CET8.8.8.8192.168.2.30x94cNo error (0)cdn.onenote.netcdn.onenote.net.edgekey.netCNAME (Canonical name)IN (0x0001)

                                                                      HTTPS Packets

                                                                      TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                      Nov 27, 2020 15:53:07.144329071 CET54.225.169.28443192.168.2.349738CN=*.ipify.org, OU=PositiveSSL Wildcard, OU=Domain Control Validated CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBWed Jan 24 01:00:00 CET 2018 Wed Feb 12 01:00:00 CET 2014 Tue Jan 19 01:00:00 CET 2010Sun Jan 24 00:59:59 CET 2021 Mon Feb 12 00:59:59 CET 2029 Tue Jan 19 00:59:59 CET 2038771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,03b5074b1b5d032e5620f69f9f700ff0e
                                                                      CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBWed Feb 12 01:00:00 CET 2014Mon Feb 12 00:59:59 CET 2029
                                                                      CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBTue Jan 19 01:00:00 CET 2010Tue Jan 19 00:59:59 CET 2038

                                                                      Code Manipulations

                                                                      Statistics

                                                                      Behavior

                                                                      Click to jump to process

                                                                      System Behavior

                                                                      Analysis Process: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe PID: 3148 Parent PID: 5536

                                                                      General

                                                                      Start time:15:51:11
                                                                      Start date:27/11/2020
                                                                      Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe'
                                                                      Imagebase:0xa50000
                                                                      File size:248832 bytes
                                                                      MD5 hash:224E779FF4D39CE90878AE3E630197E7
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:.Net C# or VB.NET
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.263990752.0000000003129000.00000004.00000001.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.264115098.00000000040A1000.00000004.00000001.sdmp, Author: Joe Security
                                                                      Reputation:low

                                                                      Analysis Process: SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe PID: 2844 Parent PID: 3148

                                                                      General

                                                                      Start time:15:51:25
                                                                      Start date:27/11/2020
                                                                      Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe
                                                                      Imagebase:0x790000
                                                                      File size:248832 bytes
                                                                      MD5 hash:224E779FF4D39CE90878AE3E630197E7
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:.Net C# or VB.NET
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.505770238.0000000002B01000.00000004.00000001.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.500003272.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.505873536.0000000002B55000.00000004.00000001.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.505873536.0000000002B55000.00000004.00000001.sdmp, Author: Joe Security
                                                                      Reputation:low

                                                                      Analysis Process: vlc.exe PID: 4120 Parent PID: 3388

                                                                      General

                                                                      Start time:15:51:35
                                                                      Start date:27/11/2020
                                                                      Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
                                                                      Imagebase:0x2c0000
                                                                      File size:248832 bytes
                                                                      MD5 hash:224E779FF4D39CE90878AE3E630197E7
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:.Net C# or VB.NET
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.314707894.00000000026E8000.00000004.00000001.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.315101943.00000000035C1000.00000004.00000001.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.313468004.00000000025C1000.00000004.00000001.sdmp, Author: Joe Security
                                                                      Antivirus matches:
                                                                      • Detection: 100%, Joe Sandbox ML
                                                                      • Detection: 38%, ReversingLabs
                                                                      Reputation:low

                                                                      Analysis Process: vlc.exe PID: 6268 Parent PID: 3388

                                                                      General

                                                                      Start time:15:51:43
                                                                      Start date:27/11/2020
                                                                      Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
                                                                      Imagebase:0x610000
                                                                      File size:248832 bytes
                                                                      MD5 hash:224E779FF4D39CE90878AE3E630197E7
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:.Net C# or VB.NET
                                                                      Reputation:low

                                                                      Analysis Process: vlc.exe PID: 6384 Parent PID: 4120

                                                                      General

                                                                      Start time:15:51:48
                                                                      Start date:27/11/2020
                                                                      Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                                                                      Imagebase:0x330000
                                                                      File size:248832 bytes
                                                                      MD5 hash:224E779FF4D39CE90878AE3E630197E7
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:low

                                                                      Analysis Process: vlc.exe PID: 6400 Parent PID: 4120

                                                                      General

                                                                      Start time:15:51:49
                                                                      Start date:27/11/2020
                                                                      Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                                                                      Imagebase:0x6c0000
                                                                      File size:248832 bytes
                                                                      MD5 hash:224E779FF4D39CE90878AE3E630197E7
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:.Net C# or VB.NET
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.505109046.0000000002B31000.00000004.00000001.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.500027054.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                      Reputation:low

                                                                      Disassembly

                                                                      Code Analysis

                                                                      Reset < >