Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report C6RET8T1Wi.exe

Overview

General Information

Sample Name:C6RET8T1Wi.exe
Analysis ID:383833
MD5:133b4a863e9a9c74b7320f54abf199d7
SHA1:d4db04a031b65254b4194bb2f1ca81a487a7fe50
SHA256:db6863fdde8111c668522696e503145c0f988ad14c248fbba9ecd4a23de83613
Tags:AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • C6RET8T1Wi.exe (PID: 6460 cmdline: 'C:\Users\user\Desktop\C6RET8T1Wi.exe' MD5: 133B4A863E9A9C74B7320F54ABF199D7)
    • schtasks.exe (PID: 6860 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ePVIisXwKSPaua' /XML 'C:\Users\user\AppData\Local\Temp\tmp8430.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • C6RET8T1Wi.exe (PID: 6968 cmdline: C:\Users\user\Desktop\C6RET8T1Wi.exe MD5: 133B4A863E9A9C74B7320F54ABF199D7)
    • C6RET8T1Wi.exe (PID: 7028 cmdline: C:\Users\user\Desktop\C6RET8T1Wi.exe MD5: 133B4A863E9A9C74B7320F54ABF199D7)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "armyscheme3@yandex.combrowse9jasmtp.yandex.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      0000000D.00000002.528245994.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000001.00000002.294530199.0000000003F46000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            13.2.C6RET8T1Wi.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.C6RET8T1Wi.exe.3fe82e0.4.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                1.2.C6RET8T1Wi.exe.3fe82e0.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

                  Sigma Overview

                  System Summary:

                  barindex
                  Sigma detected: Scheduled temp file as task from temp locationShow sources
                  Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ePVIisXwKSPaua' /XML 'C:\Users\user\AppData\Local\Temp\tmp8430.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ePVIisXwKSPaua' /XML 'C:\Users\user\AppData\Local\Temp\tmp8430.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\C6RET8T1Wi.exe' , ParentImage: C:\Users\user\Desktop\C6RET8T1Wi.exe, ParentProcessId: 6460, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ePVIisXwKSPaua' /XML 'C:\Users\user\AppData\Local\Temp\tmp8430.tmp', ProcessId: 6860

                  Signature Overview

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection:

                  barindex
                  Found malware configurationShow sources
                  Source: 13.2.C6RET8T1Wi.exe.400000.0.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "armyscheme3@yandex.combrowse9jasmtp.yandex.com"}
                  Multi AV Scanner detection for dropped fileShow sources
                  Source: C:\Users\user\AppData\Roaming\ePVIisXwKSPaua.exeReversingLabs: Detection: 37%
                  Multi AV Scanner detection for submitted fileShow sources
                  Source: C6RET8T1Wi.exeVirustotal: Detection: 41%Perma Link
                  Source: C6RET8T1Wi.exeReversingLabs: Detection: 37%
                  Machine Learning detection for dropped fileShow sources
                  Source: C:\Users\user\AppData\Roaming\ePVIisXwKSPaua.exeJoe Sandbox ML: detected
                  Machine Learning detection for sampleShow sources
                  Source: C6RET8T1Wi.exeJoe Sandbox ML: detected
                  Source: 13.2.C6RET8T1Wi.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                  Source: C6RET8T1Wi.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                  Source: C6RET8T1Wi.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: global trafficTCP traffic: 192.168.2.5:49724 -> 77.88.21.158:587
                  Source: Joe Sandbox ViewIP Address: 77.88.21.158 77.88.21.158
                  Source: global trafficTCP traffic: 192.168.2.5:49724 -> 77.88.21.158:587
                  Source: unknownDNS traffic detected: queries for: smtp.yandex.com
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpString found in binary or memory: http://NmvONo.com
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 0000000D.00000002.535134278.000000000354E000.00000004.00000001.sdmpString found in binary or memory: http://O4Irimjy3mfmBZ0.com
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ca.crl0h
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000003.265303167.0000000005ECB000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ca.cer09
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ycasha2.cer0
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291795607.0000000002DB1000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000002.291953862.0000000002E13000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291953862.0000000002E13000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.534943909.0000000003520000.00000004.00000001.sdmpString found in binary or memory: http://smtp.yandex.com
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com0.
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://www.certum.pl/CPS0
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000003.271921494.0000000005EBD000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000003.271468846.0000000005EB9000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                  Source: C6RET8T1Wi.exe, 00000001.00000003.271921494.0000000005EBD000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersuJ
                  Source: C6RET8T1Wi.exe, 00000001.00000002.298526461.0000000005EB0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comj
                  Source: C6RET8T1Wi.exe, 00000001.00000002.298526461.0000000005EB0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comrz
                  Source: C6RET8T1Wi.exe, 00000001.00000002.298526461.0000000005EB0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comt)
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                  Source: C6RET8T1Wi.exe, 00000001.00000003.265008386.0000000005ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comX
                  Source: C6RET8T1Wi.exe, 00000001.00000003.265008386.0000000005ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comx
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000003.266823416.0000000005EB4000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000003.266803258.0000000005EED000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                  Source: C6RET8T1Wi.exe, 00000001.00000003.267169299.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cr
                  Source: C6RET8T1Wi.exe, 00000001.00000003.266823416.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnGK1
                  Source: C6RET8T1Wi.exe, 00000001.00000003.266823416.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnNK&
                  Source: C6RET8T1Wi.exe, 00000001.00000003.266803258.0000000005EED000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnP
                  Source: C6RET8T1Wi.exe, 00000001.00000003.266803258.0000000005EED000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnb-n
                  Source: C6RET8T1Wi.exe, 00000001.00000003.266803258.0000000005EED000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cns
                  Source: C6RET8T1Wi.exe, 00000001.00000003.266823416.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnt
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/)
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/0
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/?
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/F
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/M
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Verdx
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0rsT
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/alny
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ico
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                  Source: C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/k
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                  Source: C6RET8T1Wi.exe, 00000001.00000003.264798854.0000000005ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comS
                  Source: C6RET8T1Wi.exe, 00000001.00000003.264798854.0000000005ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comsed~
                  Source: C6RET8T1Wi.exe, 00000001.00000003.264798854.0000000005ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comw
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                  Source: C6RET8T1Wi.exe, 00000001.00000003.266153350.0000000005EB6000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krC
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                  Source: C6RET8T1Wi.exe, 00000001.00000003.265303167.0000000005ECB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.como
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                  Source: C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: http://yandex.ocsp-responder.com03
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpString found in binary or memory: https://www.certum.pl/CPS0
                  Source: C6RET8T1Wi.exe, 00000001.00000002.294530199.0000000003F46000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 0000000D.00000002.528245994.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                  System Summary:

                  barindex
                  .NET source code contains very large array initializationsShow sources
                  Source: 13.2.C6RET8T1Wi.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b9BB50ABBu002d997Bu002d49D4u002d96BAu002dB4F190B3376Fu007d/u0036183AC38u002d4AD0u002d4B11u002d886Du002d06E3B37F3CC0.csLarge array initialization: .cctor: array initializer size 11951
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_014FD4F0
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_014F99D8
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_014FDB21
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_014F7FC1
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E277F6
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E268C8
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E20890
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E2A038
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E22019
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E262B0
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E25BD0
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E21B18
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E20CF9
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E235F0
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E235DB
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E20D08
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E27690
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E22F80
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E22F73
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E278E6
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E278D7
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E268B8
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E27889
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E20848
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E23022
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E2790D
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E272F3
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E262A0
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E25BC3
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E20BD1
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_054844BC
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_01636168
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_0163B570
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_0163A1D0
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_01633DA0
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_01632820
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_01638608
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_01635D98
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B5168
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B5D48
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B19A8
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B9450
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B90CF
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016BCA10
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B7AE8
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B5D34
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B29F0
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016BF0B8
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016BB3E0
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_030546A0
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_03054690
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_0305DA00
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_00CB6B67
                  Source: C6RET8T1Wi.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                  Source: ePVIisXwKSPaua.exe.1.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291795607.0000000002DB1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll2 vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 00000001.00000002.293757491.0000000003DBC000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll" vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 00000001.00000002.294530199.0000000003F46000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameZLGbMGFFseWUKMCXRuKzK.exe4 vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 00000001.00000002.289947497.00000000009E6000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameTypeUnion.exe< vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 00000001.00000002.301815062.000000000DA80000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 00000001.00000002.302225029.000000000DB70000.00000002.00000001.sdmpBinary or memory string: originalfilename vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 00000001.00000002.302225029.000000000DB70000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 0000000A.00000002.287952335.0000000000436000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameTypeUnion.exe< vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 0000000D.00000000.288793485.0000000000D96000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameTypeUnion.exe< vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.528245994.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameZLGbMGFFseWUKMCXRuKzK.exe4 vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.530112128.0000000001138000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.531412296.000000000140A000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.530292093.00000000011D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.531708358.0000000001640000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exeBinary or memory string: OriginalFilenameTypeUnion.exe< vs C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                  Source: C6RET8T1Wi.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: ePVIisXwKSPaua.exe.1.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: 13.2.C6RET8T1Wi.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: 13.2.C6RET8T1Wi.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@8/4@2/1
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile created: C:\Users\user\AppData\Roaming\ePVIisXwKSPaua.exeJump to behavior
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6888:120:WilError_01
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile created: C:\Users\user\AppData\Local\Temp\tmp8430.tmpJump to behavior
                  Source: C6RET8T1Wi.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
                  Source: C6RET8T1Wi.exeVirustotal: Detection: 41%
                  Source: C6RET8T1Wi.exeReversingLabs: Detection: 37%
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile read: C:\Users\user\Desktop\C6RET8T1Wi.exeJump to behavior
                  Source: unknownProcess created: C:\Users\user\Desktop\C6RET8T1Wi.exe 'C:\Users\user\Desktop\C6RET8T1Wi.exe'
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ePVIisXwKSPaua' /XML 'C:\Users\user\AppData\Local\Temp\tmp8430.tmp'
                  Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess created: C:\Users\user\Desktop\C6RET8T1Wi.exe C:\Users\user\Desktop\C6RET8T1Wi.exe
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess created: C:\Users\user\Desktop\C6RET8T1Wi.exe C:\Users\user\Desktop\C6RET8T1Wi.exe
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ePVIisXwKSPaua' /XML 'C:\Users\user\AppData\Local\Temp\tmp8430.tmp'
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess created: C:\Users\user\Desktop\C6RET8T1Wi.exe C:\Users\user\Desktop\C6RET8T1Wi.exe
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess created: C:\Users\user\Desktop\C6RET8T1Wi.exe C:\Users\user\Desktop\C6RET8T1Wi.exe
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                  Source: C6RET8T1Wi.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: C6RET8T1Wi.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_00905955 push es; ret
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E2394C push cs; ret
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_04E23953 push cs; ret
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 1_2_0548AE90 push ecx; ret
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 10_2_00355955 push es; ret
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_00CB5955 push es; ret
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_0163B4B0 pushad ; iretd
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B0312 push 8BFFFFFFh; retf
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_0305CD51 push esp; iretd
                  Source: initial sampleStatic PE information: section name: .text entropy: 7.77629150782
                  Source: initial sampleStatic PE information: section name: .text entropy: 7.77629150782
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile created: C:\Users\user\AppData\Roaming\ePVIisXwKSPaua.exeJump to dropped file

                  Boot Survival:

                  barindex
                  Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ePVIisXwKSPaua' /XML 'C:\Users\user\AppData\Local\Temp\tmp8430.tmp'
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information set: NOOPENFILEERRORBOX

                  Malware Analysis System Evasion:

                  barindex
                  Yara detected AntiVM3Show sources
                  Source: Yara matchFile source: 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: C6RET8T1Wi.exe PID: 6460, type: MEMORY
                  Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                  Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                  Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B5911 rdtsc
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeWindow / User API: threadDelayed 9291
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeWindow / User API: threadDelayed 562
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exe TID: 6464Thread sleep time: -102839s >= -30000s
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exe TID: 6488Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exe TID: 5916Thread sleep time: -13835058055282155s >= -30000s
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exe TID: 5912Thread sleep count: 9291 > 30
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exe TID: 5912Thread sleep count: 562 > 30
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeThread delayed: delay time: 102839
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeThread delayed: delay time: 922337203685477
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: vmware
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: VMWARE
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                  Source: C6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.531533408.0000000001470000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess information queried: ProcessInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016B5911 rdtsc
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeCode function: 13_2_016339D0 LdrInitializeThunk,
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess token adjusted: Debug
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess token adjusted: Debug
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeMemory allocated: page read and write | page guard

                  HIPS / PFW / Operating System Protection Evasion:

                  barindex
                  Injects a PE file into a foreign processesShow sources
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeMemory written: C:\Users\user\Desktop\C6RET8T1Wi.exe base: 400000 value starts with: 4D5A
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ePVIisXwKSPaua' /XML 'C:\Users\user\AppData\Local\Temp\tmp8430.tmp'
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess created: C:\Users\user\Desktop\C6RET8T1Wi.exe C:\Users\user\Desktop\C6RET8T1Wi.exe
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeProcess created: C:\Users\user\Desktop\C6RET8T1Wi.exe C:\Users\user\Desktop\C6RET8T1Wi.exe
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532020269.0000000001BC0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532020269.0000000001BC0000.00000002.00000001.sdmpBinary or memory string: Progman
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532020269.0000000001BC0000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532020269.0000000001BC0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
                  Source: C6RET8T1Wi.exe, 0000000D.00000002.532020269.0000000001BC0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Users\user\Desktop\C6RET8T1Wi.exe VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Users\user\Desktop\C6RET8T1Wi.exe VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                  Stealing of Sensitive Information:

                  barindex
                  Yara detected AgentTeslaShow sources
                  Source: Yara matchFile source: 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000D.00000002.528245994.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000001.00000002.294530199.0000000003F46000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: C6RET8T1Wi.exe PID: 7028, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: C6RET8T1Wi.exe PID: 6460, type: MEMORY
                  Source: Yara matchFile source: 13.2.C6RET8T1Wi.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 1.2.C6RET8T1Wi.exe.3fe82e0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 1.2.C6RET8T1Wi.exe.3fe82e0.4.unpack, type: UNPACKEDPE
                  Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                  Tries to harvest and steal browser information (history, passwords, etc)Show sources
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                  Tries to harvest and steal ftp login credentialsShow sources
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                  Tries to steal Mail credentials (via file access)Show sources
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                  Source: C:\Users\user\Desktop\C6RET8T1Wi.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                  Source: Yara matchFile source: 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: C6RET8T1Wi.exe PID: 7028, type: MEMORY

                  Remote Access Functionality:

                  barindex
                  Yara detected AgentTeslaShow sources
                  Source: Yara matchFile source: 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000D.00000002.528245994.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000001.00000002.294530199.0000000003F46000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: C6RET8T1Wi.exe PID: 7028, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: C6RET8T1Wi.exe PID: 6460, type: MEMORY
                  Source: Yara matchFile source: 13.2.C6RET8T1Wi.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 1.2.C6RET8T1Wi.exe.3fe82e0.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 1.2.C6RET8T1Wi.exe.3fe82e0.4.unpack, type: UNPACKEDPE

                  Mitre Att&ck Matrix

                  Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                  Valid AccountsWindows Management Instrumentation211Scheduled Task/Job1Process Injection112Disable or Modify Tools1OS Credential Dumping2File and Directory Discovery1Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                  Default AccountsScheduled Task/Job1Boot or Logon Initialization ScriptsScheduled Task/Job1Deobfuscate/Decode Files or Information1Credentials in Registry1System Information Discovery114Remote Desktop ProtocolData from Local System2Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                  Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information3Security Account ManagerQuery Registry1SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                  Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Software Packing3NTDSSecurity Software Discovery331Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol11SIM Card SwapCarrier Billing Fraud
                  Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptMasquerading1LSA SecretsProcess Discovery2SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                  Replication Through Removable MediaLaunchdRc.commonRc.commonVirtualization/Sandbox Evasion141Cached Domain CredentialsVirtualization/Sandbox Evasion141VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                  External Remote ServicesScheduled TaskStartup ItemsStartup ItemsProcess Injection112DCSyncApplication Window Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                  Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemRemote System Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 signatures2 2 Behavior Graph ID: 383833 Sample: C6RET8T1Wi.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 33 Found malware configuration 2->33 35 Multi AV Scanner detection for dropped file 2->35 37 Sigma detected: Scheduled temp file as task from temp location 2->37 39 7 other signatures 2->39 7 C6RET8T1Wi.exe 7 2->7         started        process3 file4 21 C:\Users\user\AppData\...\ePVIisXwKSPaua.exe, PE32 7->21 dropped 23 C:\...\ePVIisXwKSPaua.exe:Zone.Identifier, ASCII 7->23 dropped 25 C:\Users\user\AppData\Local\...\tmp8430.tmp, XML 7->25 dropped 27 C:\Users\user\AppData\...\C6RET8T1Wi.exe.log, ASCII 7->27 dropped 41 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->41 43 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->43 45 Uses schtasks.exe or at.exe to add and modify task schedules 7->45 47 Injects a PE file into a foreign processes 7->47 11 C6RET8T1Wi.exe 2 7->11         started        15 schtasks.exe 1 7->15         started        17 C6RET8T1Wi.exe 7->17         started        signatures5 process6 dnsIp7 29 smtp.yandex.ru 77.88.21.158, 49724, 587 YANDEXRU Russian Federation 11->29 31 smtp.yandex.com 11->31 49 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->49 51 Tries to steal Mail credentials (via file access) 11->51 53 Tries to harvest and steal ftp login credentials 11->53 55 Tries to harvest and steal browser information (history, passwords, etc) 11->55 19 conhost.exe 15->19         started        signatures8 process9

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  C6RET8T1Wi.exe41%VirustotalBrowse
                  C6RET8T1Wi.exe38%ReversingLabsWin32.Trojan.Wacatac
                  C6RET8T1Wi.exe100%Joe Sandbox ML

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\Users\user\AppData\Roaming\ePVIisXwKSPaua.exe100%Joe Sandbox ML
                  C:\Users\user\AppData\Roaming\ePVIisXwKSPaua.exe38%ReversingLabsWin32.Trojan.Wacatac

                  Unpacked PE Files

                  SourceDetectionScannerLabelLinkDownload
                  13.2.C6RET8T1Wi.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                  Domains

                  No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  http://www.jiyu-kobo.co.jp/Verdx0%Avira URL Cloudsafe
                  http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                  http://www.founder.com.cn/cnP0%Avira URL Cloudsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cr0%Avira URL Cloudsafe
                  http://www.jiyu-kobo.co.jp/Y0rsT0%Avira URL Cloudsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.fontbureau.comrz0%Avira URL Cloudsafe
                  http://www.jiyu-kobo.co.jp/alny0%Avira URL Cloudsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://subca.ocsp-certum.com0.0%URL Reputationsafe
                  http://subca.ocsp-certum.com0.0%URL Reputationsafe
                  http://subca.ocsp-certum.com0.0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://www.founder.com.cn/cnb-n0%Avira URL Cloudsafe
                  http://O4Irimjy3mfmBZ0.com0%Avira URL Cloudsafe
                  http://www.sajatypeworks.comS0%Avira URL Cloudsafe
                  http://www.jiyu-kobo.co.jp/00%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/00%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/00%URL Reputationsafe
                  http://www.fontbureau.comt)0%Avira URL Cloudsafe
                  http://www.founder.com.cn/cns0%Avira URL Cloudsafe
                  http://subca.ocsp-certum.com010%URL Reputationsafe
                  http://subca.ocsp-certum.com010%URL Reputationsafe
                  http://subca.ocsp-certum.com010%URL Reputationsafe
                  http://www.founder.com.cn/cnt0%URL Reputationsafe
                  http://www.founder.com.cn/cnt0%URL Reputationsafe
                  http://www.founder.com.cn/cnt0%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/)0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/)0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/)0%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  http://www.sandoll.co.krC0%Avira URL Cloudsafe
                  http://www.fonts.comx0%Avira URL Cloudsafe
                  https://api.ipify.org%0%URL Reputationsafe
                  https://api.ipify.org%0%URL Reputationsafe
                  https://api.ipify.org%0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  http://www.founder.com.cn/cnGK10%Avira URL Cloudsafe
                  http://NmvONo.com0%Avira URL Cloudsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  http://www.sajatypeworks.comw0%Avira URL Cloudsafe
                  http://www.jiyu-kobo.co.jp/M0%Avira URL Cloudsafe
                  http://www.tiro.como0%Avira URL Cloudsafe
                  http://www.jiyu-kobo.co.jp/F0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/F0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/F0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/?0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/?0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/?0%URL Reputationsafe
                  http://www.carterandcone.coml0%URL Reputationsafe
                  http://www.carterandcone.coml0%URL Reputationsafe
                  http://www.carterandcone.coml0%URL Reputationsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  smtp.yandex.ru
                  		77.88.21.158
                  		truefalse
                    		high
                    smtp.yandex.com
                    		unknown
                    		unknownfalse
                      		high

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://www.jiyu-kobo.co.jp/VerdxC6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://127.0.0.1:HTTP/1.1C6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://www.fontbureau.com/designersGC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                        		high
                        http://www.founder.com.cn/cnPC6RET8T1Wi.exe, 00000001.00000003.266803258.0000000005EED000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.fontbureau.com/designers/?C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                          		high
                          http://www.founder.com.cn/cn/bTheC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers?C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                            		high
                            http://www.founder.com.cn/cn/crC6RET8T1Wi.exe, 00000001.00000003.267169299.0000000005EB4000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://yandex.crl.certum.pl/ycasha2.crl0qC6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                              		high
                              http://www.jiyu-kobo.co.jp/Y0rsTC6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4C6RET8T1Wi.exe, 00000001.00000002.291953862.0000000002E13000.00000004.00000001.sdmpfalse
                                		high
                                http://www.tiro.comC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designersC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000003.271921494.0000000005EBD000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000003.271468846.0000000005EB9000.00000004.00000001.sdmpfalse
                                  		high
                                  http://www.goodfont.co.krC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.com/designersuJC6RET8T1Wi.exe, 00000001.00000003.271921494.0000000005EBD000.00000004.00000001.sdmpfalse
                                    		high
                                    http://www.fontbureau.comrzC6RET8T1Wi.exe, 00000001.00000002.298526461.0000000005EB0000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssC6RET8T1Wi.exe, 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmpfalse
                                      		high
                                      http://www.jiyu-kobo.co.jp/alnyC6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.sajatypeworks.comC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://subca.ocsp-certum.com0.C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.typography.netDC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://repository.certum.pl/ca.cer09C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                        		high
                                        http://www.founder.com.cn/cn/cTheC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.galapagosdesign.com/staff/dennis.htmC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://fontfabrik.comC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000003.265303167.0000000005ECB000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.founder.com.cn/cnb-nC6RET8T1Wi.exe, 00000001.00000003.266803258.0000000005EED000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://O4Irimjy3mfmBZ0.comC6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 0000000D.00000002.535134278.000000000354E000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.sajatypeworks.comSC6RET8T1Wi.exe, 00000001.00000003.264798854.0000000005ECB000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.jiyu-kobo.co.jp/0C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.comt)C6RET8T1Wi.exe, 00000001.00000002.298526461.0000000005EB0000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		low
                                        http://www.founder.com.cn/cnsC6RET8T1Wi.exe, 00000001.00000003.266803258.0000000005EED000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://subca.ocsp-certum.com01C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.founder.com.cn/cntC6RET8T1Wi.exe, 00000001.00000003.266823416.0000000005EB4000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.galapagosdesign.com/DPleaseC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.jiyu-kobo.co.jp/)C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        https://api.ipify.org%GETMozilla/5.0C6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		low
                                        http://www.fonts.comC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                          		high
                                          http://www.sandoll.co.krC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.urwpp.deDPleaseC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.zhongyicts.com.cnC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameC6RET8T1Wi.exe, 00000001.00000002.291795607.0000000002DB1000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000002.291953862.0000000002E13000.00000004.00000001.sdmpfalse
                                            		high
                                            http://www.sakkal.comC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.sandoll.co.krCC6RET8T1Wi.exe, 00000001.00000003.266153350.0000000005EB6000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.fonts.comxC6RET8T1Wi.exe, 00000001.00000003.265008386.0000000005ECB000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://api.ipify.org%C6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		low
                                            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipC6RET8T1Wi.exe, 00000001.00000002.294530199.0000000003F46000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 0000000D.00000002.528245994.0000000000402000.00000040.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.certum.pl/CPS0C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                              		high
                                              http://www.founder.com.cn/cnGK1C6RET8T1Wi.exe, 00000001.00000003.266823416.0000000005EB4000.00000004.00000001.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://NmvONo.comC6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://repository.certum.pl/ycasha2.cer0C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                                		high
                                                http://www.apache.org/licenses/LICENSE-2.0C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                                  		high
                                                  http://www.fontbureau.comC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                                    		high
                                                    http://DynDns.comDynDNSC6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://repository.certum.pl/ctnca.cer09C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                                      		high
                                                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haC6RET8T1Wi.exe, 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://crl.certum.pl/ctnca.crl0kC6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                                        		high
                                                        http://www.sajatypeworks.comwC6RET8T1Wi.exe, 00000001.00000003.264798854.0000000005ECB000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.jiyu-kobo.co.jp/MC6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.tiro.comoC6RET8T1Wi.exe, 00000001.00000003.265303167.0000000005ECB000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.jiyu-kobo.co.jp/FC6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://www.certum.pl/CPS0C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                                          		high
                                                          http://www.jiyu-kobo.co.jp/jp/C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://www.fonts.comXC6RET8T1Wi.exe, 00000001.00000003.265008386.0000000005ECB000.00000004.00000001.sdmpfalse
                                                            		unknown
                                                            http://www.jiyu-kobo.co.jp/?C6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://smtp.yandex.comC6RET8T1Wi.exe, 0000000D.00000002.534943909.0000000003520000.00000004.00000001.sdmpfalse
                                                              		high
                                                              http://www.carterandcone.comlC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://yandex.ocsp-responder.com03C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://www.fontbureau.comjC6RET8T1Wi.exe, 00000001.00000002.298526461.0000000005EB0000.00000004.00000001.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://www.founder.com.cn/cnNK&C6RET8T1Wi.exe, 00000001.00000003.266823416.0000000005EB4000.00000004.00000001.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://www.fontbureau.com/designers/cabarga.htmlNC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                                                		high
                                                                http://www.founder.com.cn/cnC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000003.266823416.0000000005EB4000.00000004.00000001.sdmp, C6RET8T1Wi.exe, 00000001.00000003.266803258.0000000005EED000.00000004.00000001.sdmpfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                		unknown
                                                                http://www.fontbureau.com/designers/frere-jones.htmlC6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                                                  		high
                                                                  http://crls.yandex.net/certum/ycasha2.crl0-C6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                                                    		high
                                                                    http://www.jiyu-kobo.co.jp/icoC6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.jiyu-kobo.co.jp/C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://www.jiyu-kobo.co.jp/kC6RET8T1Wi.exe, 00000001.00000003.268941436.0000000005EB4000.00000004.00000001.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://www.fontbureau.com/designers8C6RET8T1Wi.exe, 00000001.00000002.299365680.00000000070C2000.00000004.00000001.sdmpfalse
                                                                      		high
                                                                      http://crl.certum.pl/ca.crl0hC6RET8T1Wi.exe, 0000000D.00000002.535007261.000000000352A000.00000004.00000001.sdmpfalse
                                                                        		high
                                                                        http://www.sajatypeworks.comsed~C6RET8T1Wi.exe, 00000001.00000003.264798854.0000000005ECB000.00000004.00000001.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		low

                                                                        Contacted IPs

                                                                        • No. of IPs < 25%
                                                                        • 25% < No. of IPs < 50%
                                                                        • 50% < No. of IPs < 75%
                                                                        • 75% < No. of IPs

                                                                        Public

                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                        77.88.21.158
                                                                        		smtp.yandex.ruRussian Federation
                                                                        		13238YANDEXRUfalse

                                                                        General Information

                                                                        Joe Sandbox Version:31.0.0 Emerald
                                                                        Analysis ID:383833
                                                                        Start date:08.04.2021
                                                                        Start time:10:46:53
                                                                        Joe Sandbox Product:CloudBasic
                                                                        Overall analysis duration:0h 10m 56s
                                                                        Hypervisor based Inspection enabled:false
                                                                        Report type:light
                                                                        Sample file name:C6RET8T1Wi.exe
                                                                        Cookbook file name:default.jbs
                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                        Number of analysed new started processes analysed:25
                                                                        Number of new started drivers analysed:0
                                                                        Number of existing processes analysed:0
                                                                        Number of existing drivers analysed:0
                                                                        Number of injected processes analysed:0
                                                                        Technologies:
                                                                        • HCA enabled
                                                                        • EGA enabled
                                                                        • HDC enabled
                                                                        • AMSI enabled
                                                                        Analysis Mode:default
                                                                        Analysis stop reason:Timeout
                                                                        Detection:MAL
                                                                        Classification:mal100.troj.spyw.evad.winEXE@8/4@2/1
                                                                        EGA Information:Failed
                                                                        HDC Information:Failed
                                                                        HCA Information:
                                                                        • Successful, ratio: 100%
                                                                        • Number of executed functions: 0
                                                                        • Number of non-executed functions: 0
                                                                        Cookbook Comments:
                                                                        • Adjust boot time
                                                                        • Enable AMSI
                                                                        • Found application associated with file extension: .exe
                                                                        Warnings:
                                                                        Show All
                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                        • Excluded IPs from analysis (whitelisted): 93.184.220.29, 204.79.197.200, 13.107.21.200, 20.50.102.62, 104.43.139.144, 52.255.188.83, 23.54.113.53, 104.42.151.234, 52.147.198.201, 95.100.54.203, 20.82.210.154, 23.10.249.26, 23.10.249.43, 20.54.26.129
                                                                        • Excluded domains from analysis (whitelisted): cs9.wac.phicdn.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, ocsp.digicert.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net
                                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                        • Report size getting too big, too many NtQueryValueKey calls found.

                                                                        Simulations

                                                                        Behavior and APIs

                                                                        TimeTypeDescription
                                                                        10:48:13API Interceptor706x Sleep call for process: C6RET8T1Wi.exe modified

                                                                        Joe Sandbox View / Context

                                                                        IPs

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                        77.88.21.158RFQ# ZAT77095_pdf.exeGet hashmaliciousBrowse
                                                                          AL JUNEIDI LIST.xlsxGet hashmaliciousBrowse
                                                                            SWIFT.exeGet hashmaliciousBrowse
                                                                              Payment _Advice (2).exeGet hashmaliciousBrowse
                                                                                cricket.exeGet hashmaliciousBrowse
                                                                                  SG1_000000123205044_1.pdf.gz.exeGet hashmaliciousBrowse
                                                                                    Ordine d'acquisto 240517_04062021.exeGet hashmaliciousBrowse
                                                                                      Order 01042021-V728394-H16.pdf.exeGet hashmaliciousBrowse
                                                                                        RFQ#EX50GO_pdf.exeGet hashmaliciousBrowse
                                                                                          TRANSACTION_INTTRANSFER_1617266945242 MEDICON_PDF.exeGet hashmaliciousBrowse
                                                                                            Shandong CIRS Form.exeGet hashmaliciousBrowse
                                                                                              DHL_DELIVERY_CONFIRMATION_CBJ002042021068506.exeGet hashmaliciousBrowse
                                                                                                REQUEST QUOTATION BID..pdf.exeGet hashmaliciousBrowse
                                                                                                  RFQ#ZAEL67012_doc.exeGet hashmaliciousBrowse
                                                                                                    Q99Eljz7IT.exeGet hashmaliciousBrowse
                                                                                                      SecuriteInfo.com.Trojan.PackedNET.576.12750.exeGet hashmaliciousBrowse
                                                                                                        Swift Copy Against due Invoice.PDF.exeGet hashmaliciousBrowse
                                                                                                          PO#ZA3MMA_pdf.exeGet hashmaliciousBrowse
                                                                                                            kfMrlKSN4F.exeGet hashmaliciousBrowse
                                                                                                              xjvIB3Wkvk.exeGet hashmaliciousBrowse

                                                                                                                Domains

                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                smtp.yandex.ruRFQ# ZAT77095_pdf.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                AL JUNEIDI LIST.xlsxGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                SWIFT.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Payment _Advice (2).exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                cricket.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                SG1_000000123205044_1.pdf.gz.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Ordine d'acquisto 240517_04062021.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Order 01042021-V728394-H16.pdf.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                RFQ#EX50GO_pdf.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                TRANSACTION_INTTRANSFER_1617266945242 MEDICON_PDF.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Shandong CIRS Form.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                DHL_DELIVERY_CONFIRMATION_CBJ002042021068506.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                REQUEST QUOTATION BID..pdf.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                RFQ#ZAEL67012_doc.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Q99Eljz7IT.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                SecuriteInfo.com.Trojan.PackedNET.576.12750.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Swift Copy Against due Invoice.PDF.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                PO#ZA3MMA_pdf.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                kfMrlKSN4F.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                xjvIB3Wkvk.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158

                                                                                                                ASN

                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                YANDEXRURFQ# ZAT77095_pdf.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                AL JUNEIDI LIST.xlsxGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                SWIFT.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Payment _Advice (2).exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                cricket.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                SG1_000000123205044_1.pdf.gz.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Ordine d'acquisto 240517_04062021.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                _VmailMessage_Wave19922626.htmlGet hashmaliciousBrowse
                                                                                                                • 77.88.21.179
                                                                                                                Order 01042021-V728394-H16.pdf.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                RFQ#EX50GO_pdf.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                TRANSACTION_INTTRANSFER_1617266945242 MEDICON_PDF.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Shandong CIRS Form.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                DHL_DELIVERY_CONFIRMATION_CBJ002042021068506.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                REQUEST QUOTATION BID..pdf.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                RFQ#ZAEL67012_doc.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Q99Eljz7IT.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                SecuriteInfo.com.Trojan.PackedNET.576.12750.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                Swift Copy Against due Invoice.PDF.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158
                                                                                                                scan-100218.docmGet hashmaliciousBrowse
                                                                                                                • 93.158.134.119
                                                                                                                PO#ZA3MMA_pdf.exeGet hashmaliciousBrowse
                                                                                                                • 77.88.21.158

                                                                                                                JA3 Fingerprints

                                                                                                                No context

                                                                                                                Dropped Files

                                                                                                                No context

                                                                                                                Created / dropped Files

                                                                                                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\C6RET8T1Wi.exe.log
                                                                                                                Process:C:\Users\user\Desktop\C6RET8T1Wi.exe
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:modified
                                                                                                                Size (bytes):1314
                                                                                                                Entropy (8bit):5.350128552078965
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
                                                                                                                MD5:1DC1A2DCC9EFAA84EABF4F6D6066565B
                                                                                                                SHA1:B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
                                                                                                                SHA-256:28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
                                                                                                                SHA-512:95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
                                                                                                                Malicious:true
                                                                                                                Reputation:high, very likely benign file
                                                                                                                Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a
                                                                                                                C:\Users\user\AppData\Local\Temp\tmp8430.tmp
                                                                                                                Process:C:\Users\user\Desktop\C6RET8T1Wi.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1651
                                                                                                                Entropy (8bit):5.172916200556988
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBi0tn:cbhC7ZlNQF/rydbz9I3YODOLNdq3L
                                                                                                                MD5:0DA72E8020ACC34E9DF0550E2446BF92
                                                                                                                SHA1:33C2C9C78819261F163B778AADC7E7FA0E289C20
                                                                                                                SHA-256:E7D5394DC8C71CE85A1CB3DA70F23E1D016CD5E51136A17D41E9177F04FDA18C
                                                                                                                SHA-512:AD60907A0468FFEB0950A60A247F61E46ECB9DBFE9B24365966867DDA7A9B6A4DEEE2E007210CF9BCF26A443EBBF04E4B0B3F428791C469B4D0329D503E0E14B
                                                                                                                Malicious:true
                                                                                                                Reputation:low
                                                                                                                Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t
                                                                                                                C:\Users\user\AppData\Roaming\ePVIisXwKSPaua.exe
                                                                                                                Process:C:\Users\user\Desktop\C6RET8T1Wi.exe
                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1031168
                                                                                                                Entropy (8bit):7.5599836445937
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24576:N1TbhttyDnl8+3Jsesv+1yrA/Jp/jO9BvLe:NTttonlvsGX//bOvL
                                                                                                                MD5:133B4A863E9A9C74B7320F54ABF199D7
                                                                                                                SHA1:D4DB04A031B65254B4194BB2F1CA81A487A7FE50
                                                                                                                SHA-256:DB6863FDDE8111C668522696E503145C0F988AD14C248FBBA9ECD4A23DE83613
                                                                                                                SHA-512:C24F5DC2C8D27D7DA9A8D4B91201E33A4748B67368605ABE016256DE73066E9E99E9FD9012444A1548320ECB0C60CF9494635B0071F656EB4632177AEADC2C57
                                                                                                                Malicious:true
                                                                                                                Antivirus:
                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                • Antivirus: ReversingLabs, Detection: 38%
                                                                                                                Reputation:low
                                                                                                                Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;m`..............P..8..........^W... ...`....@.. ....................................@..................................W..O....`............................................................................... ............... ..H............text...d7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc..............................@..B................@W......H.......|<...O..........\................................................0............(....(..........(.....o.....*.....................( ......(!......("......(#......($....*N..(....o....(%....*&..(&....*.s'........s(........s)........s*........s+........*....0...........~....o,....+..*.0...........~....o-....+..*.0...........~....o.....+..*.0...........~....o/....+..*.0...........~....o0....+..*.0..<........~.....(1.....,!r...p.....(2...o3...s4............~.....+..*.0......
                                                                                                                C:\Users\user\AppData\Roaming\ePVIisXwKSPaua.exe:Zone.Identifier
                                                                                                                Process:C:\Users\user\Desktop\C6RET8T1Wi.exe
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):26
                                                                                                                Entropy (8bit):3.95006375643621
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:ggPYV:rPYV
                                                                                                                MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                Malicious:true
                                                                                                                Reputation:high, very likely benign file
                                                                                                                Preview: [ZoneTransfer]....ZoneId=0

                                                                                                                Static File Info

                                                                                                                General

                                                                                                                File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Entropy (8bit):7.5599836445937
                                                                                                                TrID:
                                                                                                                • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                                                • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                                                • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                • DOS Executable Generic (2002/1) 0.01%
                                                                                                                File name:C6RET8T1Wi.exe
                                                                                                                File size:1031168
                                                                                                                MD5:133b4a863e9a9c74b7320f54abf199d7
                                                                                                                SHA1:d4db04a031b65254b4194bb2f1ca81a487a7fe50
                                                                                                                SHA256:db6863fdde8111c668522696e503145c0f988ad14c248fbba9ecd4a23de83613
                                                                                                                SHA512:c24f5dc2c8d27d7da9a8d4b91201e33a4748b67368605abe016256de73066e9e99e9fd9012444a1548320ecb0c60cf9494635b0071f656eb4632177aeadc2c57
                                                                                                                SSDEEP:24576:N1TbhttyDnl8+3Jsesv+1yrA/Jp/jO9BvLe:NTttonlvsGX//bOvL
                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;m`..............P..8..........^W... ...`....@.. ....................................@................................

                                                                                                                File Icon

                                                                                                                Icon Hash:d28ab3b0e0ab96c4

                                                                                                                Static PE Info

                                                                                                                General

                                                                                                                Entrypoint:0x4d575e
                                                                                                                Entrypoint Section:.text
                                                                                                                Digitally signed:false
                                                                                                                Imagebase:0x400000
                                                                                                                Subsystem:windows gui
                                                                                                                Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                                                                                DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                                                                Time Stamp:0x606D3B0F [Wed Apr 7 04:54:39 2021 UTC]
                                                                                                                TLS Callbacks:
                                                                                                                CLR (.Net) Version:v4.0.30319
                                                                                                                OS Version Major:4
                                                                                                                OS Version Minor:0
                                                                                                                File Version Major:4
                                                                                                                File Version Minor:0
                                                                                                                Subsystem Version Major:4
                                                                                                                Subsystem Version Minor:0
                                                                                                                Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                Entrypoint Preview

                                                                                                                Instruction
                                                                                                                jmp dword ptr [00402000h]
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al

                                                                                                                Data Directories

                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0xd570c0x4f.text
                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xd60000x28000.rsrc
                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0xfe0000xc.reloc
                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                Sections

                                                                                                                NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                .text0x20000xd37640xd3800False0.852953466681data7.77629150782IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                .rsrc0xd60000x280000x28000False0.348266601562data5.33199734146IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                .reloc0xfe0000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                Resources

                                                                                                                NameRVASizeTypeLanguageCountry
                                                                                                                RT_ICON0xd62800x10828dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
                                                                                                                RT_ICON0xe6aa80x94a8data
                                                                                                                RT_ICON0xeff500x5488data
                                                                                                                RT_ICON0xf53d80x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295
                                                                                                                RT_ICON0xf96000x25a8data
                                                                                                                RT_ICON0xfbba80x10a8data
                                                                                                                RT_ICON0xfcc500x988data
                                                                                                                RT_ICON0xfd5d80x468GLS_BINARY_LSB_FIRST
                                                                                                                RT_GROUP_ICON0xfda400x76data
                                                                                                                RT_VERSION0xfdab80x35cdata
                                                                                                                RT_MANIFEST0xfde140x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                                                                Imports

                                                                                                                DLLImport
                                                                                                                mscoree.dll_CorExeMain

                                                                                                                Version Infos

                                                                                                                DescriptionData
                                                                                                                Translation0x0000 0x04b0
                                                                                                                LegalCopyrightCopyright 2021
                                                                                                                Assembly Version7.0.0.1
                                                                                                                InternalNameTypeUnion.exe
                                                                                                                FileVersion7.0.0.1
                                                                                                                CompanyNameFileCodeGroup
                                                                                                                LegalTrademarks
                                                                                                                CommentsFileCodeGroup
                                                                                                                ProductNameMajor Project
                                                                                                                ProductVersion7.0.0.1
                                                                                                                FileDescriptionMajor Project
                                                                                                                OriginalFilenameTypeUnion.exe

                                                                                                                Network Behavior

                                                                                                                Network Port Distribution

                                                                                                                TCP Packets

                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                Apr 8, 2021 10:50:04.697968960 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:04.757010937 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:04.757100105 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:04.956531048 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:04.957103968 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.016175985 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.016228914 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.016913891 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.075756073 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.131339073 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.189738035 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.250076056 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.250133038 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.250169992 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.250202894 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.250351906 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.250478029 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.321717978 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.381097078 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.429044008 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.727226019 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.786475897 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.788240910 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.847610950 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.848956108 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.919176102 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.923804998 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:05.990900993 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:05.991934061 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:06.057542086 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:06.058021069 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:06.116939068 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:06.120604038 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:06.120918989 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:06.121618986 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:06.121798038 CEST49724587192.168.2.577.88.21.158
                                                                                                                Apr 8, 2021 10:50:06.179809093 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:06.180265903 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:06.493727922 CEST5874972477.88.21.158192.168.2.5
                                                                                                                Apr 8, 2021 10:50:06.537614107 CEST49724587192.168.2.577.88.21.158

                                                                                                                UDP Packets

                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                Apr 8, 2021 10:47:45.395198107 CEST5270453192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:47:45.407685995 CEST53527048.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:47:45.516362906 CEST5221253192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:47:45.529778957 CEST53522128.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:47:45.551681995 CEST5430253192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:47:45.563613892 CEST53543028.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:47:45.584640026 CEST5378453192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:47:45.598089933 CEST53537848.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:47:45.763812065 CEST6530753192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:47:45.789467096 CEST53653078.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:47:46.132524967 CEST6434453192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:47:46.145257950 CEST53643448.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:47:47.134906054 CEST6206053192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:47:47.148159027 CEST53620608.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:47:52.575403929 CEST6180553192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:47:52.589293003 CEST53618058.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:02.747829914 CEST5479553192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:02.759968996 CEST53547958.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:04.927238941 CEST4955753192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:04.940278053 CEST53495578.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:06.155400038 CEST6173353192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:06.167747021 CEST53617338.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:07.196096897 CEST6544753192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:07.217538118 CEST53654478.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:08.452764988 CEST5244153192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:08.465712070 CEST53524418.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:19.151809931 CEST6217653192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:19.164824963 CEST53621768.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:20.287110090 CEST5959653192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:20.300358057 CEST53595968.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:22.635272026 CEST6529653192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:22.647893906 CEST53652968.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:23.028289080 CEST6318353192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:23.040791988 CEST53631838.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:29.042406082 CEST6015153192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:29.060874939 CEST53601518.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:30.959913969 CEST5696953192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:30.973500013 CEST53569698.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:48:43.710974932 CEST5516153192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:48:43.723860979 CEST53551618.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:49:04.555234909 CEST5475753192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:49:04.567758083 CEST53547578.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:49:07.309771061 CEST4999253192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:49:07.329549074 CEST53499928.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:49:22.174190998 CEST6007553192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:49:22.200989008 CEST53600758.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:49:43.669694901 CEST5501653192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:49:43.682336092 CEST53550168.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:49:45.390861034 CEST6434553192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:49:45.404653072 CEST53643458.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:50:04.505937099 CEST5712853192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:50:04.519083023 CEST53571288.8.8.8192.168.2.5
                                                                                                                Apr 8, 2021 10:50:04.538531065 CEST5479153192.168.2.58.8.8.8
                                                                                                                Apr 8, 2021 10:50:04.552460909 CEST53547918.8.8.8192.168.2.5

                                                                                                                DNS Queries

                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                Apr 8, 2021 10:50:04.505937099 CEST192.168.2.58.8.8.80xf1a2Standard query (0)smtp.yandex.comA (IP address)IN (0x0001)
                                                                                                                Apr 8, 2021 10:50:04.538531065 CEST192.168.2.58.8.8.80x7614Standard query (0)smtp.yandex.comA (IP address)IN (0x0001)

                                                                                                                DNS Answers

                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                Apr 8, 2021 10:50:04.519083023 CEST8.8.8.8192.168.2.50xf1a2No error (0)smtp.yandex.comsmtp.yandex.ruCNAME (Canonical name)IN (0x0001)
                                                                                                                Apr 8, 2021 10:50:04.519083023 CEST8.8.8.8192.168.2.50xf1a2No error (0)smtp.yandex.ru77.88.21.158A (IP address)IN (0x0001)
                                                                                                                Apr 8, 2021 10:50:04.552460909 CEST8.8.8.8192.168.2.50x7614No error (0)smtp.yandex.comsmtp.yandex.ruCNAME (Canonical name)IN (0x0001)
                                                                                                                Apr 8, 2021 10:50:04.552460909 CEST8.8.8.8192.168.2.50x7614No error (0)smtp.yandex.ru77.88.21.158A (IP address)IN (0x0001)

                                                                                                                SMTP Packets

                                                                                                                TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                                Apr 8, 2021 10:50:04.956531048 CEST5874972477.88.21.158192.168.2.5220 vla3-3dd1bd6927b2.qloud-c.yandex.net ESMTP (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru)
                                                                                                                Apr 8, 2021 10:50:04.957103968 CEST49724587192.168.2.577.88.21.158EHLO 888683
                                                                                                                Apr 8, 2021 10:50:05.016228914 CEST5874972477.88.21.158192.168.2.5250-vla3-3dd1bd6927b2.qloud-c.yandex.net
                                                                                                                250-8BITMIME
                                                                                                                250-PIPELINING
                                                                                                                250-SIZE 42991616
                                                                                                                250-STARTTLS
                                                                                                                250-AUTH LOGIN PLAIN XOAUTH2
                                                                                                                250-DSN
                                                                                                                250 ENHANCEDSTATUSCODES
                                                                                                                Apr 8, 2021 10:50:05.016913891 CEST49724587192.168.2.577.88.21.158STARTTLS
                                                                                                                Apr 8, 2021 10:50:05.075756073 CEST5874972477.88.21.158192.168.2.5220 Go ahead

                                                                                                                Code Manipulations

                                                                                                                Statistics

                                                                                                                Behavior

                                                                                                                Click to jump to process

                                                                                                                System Behavior

                                                                                                                Analysis Process: C6RET8T1Wi.exe PID: 6460 Parent PID: 5628

                                                                                                                General

                                                                                                                Start time:10:48:04
                                                                                                                Start date:08/04/2021
                                                                                                                Path:C:\Users\user\Desktop\C6RET8T1Wi.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:'C:\Users\user\Desktop\C6RET8T1Wi.exe'
                                                                                                                Imagebase:0x900000
                                                                                                                File size:1031168 bytes
                                                                                                                MD5 hash:133B4A863E9A9C74B7320F54ABF199D7
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:.Net C# or VB.NET
                                                                                                                Yara matches:
                                                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.294530199.0000000003F46000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.291906336.0000000002DFC000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                Reputation:low

                                                                                                                Analysis Process: schtasks.exe PID: 6860 Parent PID: 6460

                                                                                                                General

                                                                                                                Start time:10:48:15
                                                                                                                Start date:08/04/2021
                                                                                                                Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ePVIisXwKSPaua' /XML 'C:\Users\user\AppData\Local\Temp\tmp8430.tmp'
                                                                                                                Imagebase:0xac0000
                                                                                                                File size:185856 bytes
                                                                                                                MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:high

                                                                                                                Analysis Process: conhost.exe PID: 6888 Parent PID: 6860

                                                                                                                General

                                                                                                                Start time:10:48:16
                                                                                                                Start date:08/04/2021
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff797770000
                                                                                                                File size:625664 bytes
                                                                                                                MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:high

                                                                                                                Analysis Process: C6RET8T1Wi.exe PID: 6968 Parent PID: 6460

                                                                                                                General

                                                                                                                Start time:10:48:16
                                                                                                                Start date:08/04/2021
                                                                                                                Path:C:\Users\user\Desktop\C6RET8T1Wi.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Users\user\Desktop\C6RET8T1Wi.exe
                                                                                                                Imagebase:0x350000
                                                                                                                File size:1031168 bytes
                                                                                                                MD5 hash:133B4A863E9A9C74B7320F54ABF199D7
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:low

                                                                                                                Analysis Process: C6RET8T1Wi.exe PID: 7028 Parent PID: 6460

                                                                                                                General

                                                                                                                Start time:10:48:17
                                                                                                                Start date:08/04/2021
                                                                                                                Path:C:\Users\user\Desktop\C6RET8T1Wi.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:C:\Users\user\Desktop\C6RET8T1Wi.exe
                                                                                                                Imagebase:0xcb0000
                                                                                                                File size:1031168 bytes
                                                                                                                MD5 hash:133B4A863E9A9C74B7320F54ABF199D7
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:.Net C# or VB.NET
                                                                                                                Yara matches:
                                                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.532839988.00000000031B1000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.528245994.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                                                Reputation:low

                                                                                                                Disassembly

                                                                                                                Code Analysis

                                                                                                                Reset < >