Play interactive tour

Edit tour

Analysis Report zTM9EtIGQK.exe

Overview

General Information

Sample Name:	zTM9EtIGQK.exe
Analysis ID:	383945
MD5:	01158bfc4ce6cb2c5a3cdbf661f13f8b
SHA1:	4d18044e5cfa5ebb9b397dd742648db870b1f32a
SHA256:	4ee443331bdebfdfffa8f7fe75c1434504a900dc792561390f27c3f9f0c8bc09
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

zTM9EtIGQK.exe (PID: 2996 cmdline: 'C:\Users\user\Desktop\zTM9EtIGQK.exe' MD5: 01158BFC4CE6CB2C5A3CDBF661F13F8B)

schtasks.exe (PID: 5852 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

zTM9EtIGQK.exe (PID: 4864 cmdline: C:\Users\user\Desktop\zTM9EtIGQK.exe MD5: 01158BFC4CE6CB2C5A3CDBF661F13F8B)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "armyscheme3@yandex.combrowse9jasmtp.yandex.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.483950823.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.262469777.0000000003581000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: zTM9EtIGQK.exe PID: 4864	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: zTM9EtIGQK.exe PID: 4864	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: zTM9EtIGQK.exe PID: 2996	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: zTM9EtIGQK.exe PID: 2996	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.zTM9EtIGQK.exe.36231a0.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.zTM9EtIGQK.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.zTM9EtIGQK.exe.36231a0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

System Summary:

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\zTM9EtIGQK.exe' , ParentImage: C:\Users\user\Desktop\zTM9EtIGQK.exe, ParentProcessId: 2996, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp', ProcessId: 5852

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: zTM9EtIGQK.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe

Avira: detection malicious, Label: HEUR/AGEN.1138557

Found malware configuration

Show sources

Source: 0.2.zTM9EtIGQK.exe.36231a0.2.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "armyscheme3@yandex.combrowse9jasmtp.yandex.com"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe

ReversingLabs: Detection: 35%

Multi AV Scanner detection for submitted file

Show sources

Source: zTM9EtIGQK.exe	Virustotal: Detection: 32%			Perma Link
Source: zTM9EtIGQK.exe	ReversingLabs: Detection: 35%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: zTM9EtIGQK.exe

Joe Sandbox ML: detected

Source: 7.2.zTM9EtIGQK.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: zTM9EtIGQK.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: zTM9EtIGQK.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0E6D1060
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0E6D2FC0
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0E6D2FAF
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0E6D1050

Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: http://NmvONo.com
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0h
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://repository.certum.pl/ca.cer09
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://repository.certum.pl/ycasha2.cer0
Source: zTM9EtIGQK.exe, 00000000.00000002.261724513.00000000024C1000.00000004.00000001.sdmp, zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
Source: zTM9EtIGQK.exe, 00000007.00000002.494240674.0000000003314000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.yandex.com
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://subca.ocsp-certum.com0.
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: zTM9EtIGQK.exe	String found in binary or memory: http://tempuri.org/GridOneHSDataSet.xsd
Source: zTM9EtIGQK.exe	String found in binary or memory: http://tempuri.org/HighScoresDataSet.xsd
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: zTM9EtIGQK.exe, 00000000.00000002.261241887.0000000000C07000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comicta
Source: zTM9EtIGQK.exe, 00000000.00000002.261241887.0000000000C07000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: zTM9EtIGQK.exe, 00000000.00000003.219533614.00000000054EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comHC
Source: zTM9EtIGQK.exe, 00000000.00000003.219397829.00000000054EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com~C
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: zTM9EtIGQK.exe, 00000000.00000003.221443733.00000000054E1000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnE
Source: zTM9EtIGQK.exe, 00000000.00000003.221443733.00000000054E1000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnd
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: zTM9EtIGQK.exe, 00000000.00000003.219814071.00000000054EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comZC
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: http://yandex.ocsp-responder.com03
Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp, zTM9EtIGQK.exe, 00000007.00000002.494359087.0000000003340000.00000004.00000001.sdmp	String found in binary or memory: https://K7p4S11uSBScHXT6.com
Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%
Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: zTM9EtIGQK.exe, 00000000.00000002.262469777.0000000003581000.00000004.00000001.sdmp, zTM9EtIGQK.exe, 00000007.00000002.483950823.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 7.2.zTM9EtIGQK.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b9BB50ABBu002d997Bu002d49D4u002d96BAu002dB4F190B3376Fu007d/u0036183AC38u002d4AD0u002d4B11u002d886Du002d06E3B37F3CC0.cs

Large array initialization: .cctor: array initializer size 11951

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD6EA8 NtQueryInformationProcess,		0_2_06DD6EA8
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD6EA0 NtQueryInformationProcess,		0_2_06DD6EA0

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_000FA9EA	0_2_000FA9EA
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_0235C2B0	0_2_0235C2B0
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_02359990	0_2_02359990
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD54C0	0_2_06DD54C0
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD6C60	0_2_06DD6C60
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DDC420	0_2_06DDC420
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD7A78	0_2_06DD7A78
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DDCB00	0_2_06DDCB00
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DDD130	0_2_06DDD130
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD8650	0_2_06DD8650
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD8660	0_2_06DD8660
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD7FD9	0_2_06DD7FD9
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD7FE8	0_2_06DD7FE8
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD5768	0_2_06DD5768
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD54B0	0_2_06DD54B0
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD6459	0_2_06DD6459
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD6468	0_2_06DD6468
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD5D88	0_2_06DD5D88
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD7D84	0_2_06DD7D84
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD2DB0	0_2_06DD2DB0
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD2DAE	0_2_06DD2DAE
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD5D4C	0_2_06DD5D4C
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD2258	0_2_06DD2258
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD7A5B	0_2_06DD7A5B
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD2268	0_2_06DD2268
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD7A1F	0_2_06DD7A1F
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD1B88	0_2_06DD1B88
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD1B78	0_2_06DD1B78
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD9318	0_2_06DD9318
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD9308	0_2_06DD9308
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD08F8	0_2_06DD08F8
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD2053	0_2_06DD2053
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD9818	0_2_06DD9818
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD9807	0_2_06DD9807
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD2038	0_2_06DD2038
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD2028	0_2_06DD2028
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD0908	0_2_06DD0908
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_0E6D2B88	0_2_0E6D2B88
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_0E6D1860	0_2_0E6D1860
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_000FAAC7	0_2_000FAAC7
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_000FAA54	0_2_000FAA54
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_00CEA9EA	7_2_00CEA9EA
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_01432D50	7_2_01432D50
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_01432020	7_2_01432020
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_0143AB70	7_2_0143AB70
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_01432618	7_2_01432618
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_0143B110	7_2_0143B110
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_0143D980	7_2_0143D980
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_0143BDBC	7_2_0143BDBC
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_0143EE10	7_2_0143EE10
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_02EA46A0	7_2_02EA46A0
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_02EA4690	7_2_02EA4690
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_02EA4672	7_2_02EA4672
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_05B97540	7_2_05B97540
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_05B994F8	7_2_05B994F8
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_05B96C70	7_2_05B96C70
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_05B96928	7_2_05B96928
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_00CEAAC7	7_2_00CEAAC7
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_00CEAA54	7_2_00CEAA54
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_05B9257B	7_2_05B9257B
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_05B92680	7_2_05B92680

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe 4EE443331BDEBFDFFFA8F7FE75C1434504A900DC792561390F27C3F9F0C8BC09

Source: zTM9EtIGQK.exe	Binary or memory string: OriginalFilename vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000000.00000002.270432002.000000000E3D0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000000.00000002.270432002.000000000E3D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameZLGbMGFFseWUKMCXRuKzK.exe4 vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll2 vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000000.00000002.267978645.0000000006D40000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll" vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000000.00000003.258888468.000000000DB66000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameFilter.exe4 vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000000.00000002.268399680.00000000083F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000000.00000002.269700084.000000000E2D0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe	Binary or memory string: OriginalFilename vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000007.00000000.257991876.0000000000CE2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFilter.exe4 vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000007.00000002.483950823.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameZLGbMGFFseWUKMCXRuKzK.exe4 vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000007.00000002.498895022.0000000006580000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe, 00000007.00000002.489837671.00000000014A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs zTM9EtIGQK.exe
Source: zTM9EtIGQK.exe	Binary or memory string: OriginalFilenameFilter.exe4 vs zTM9EtIGQK.exe

Source: zTM9EtIGQK.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: zTM9EtIGQK.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VKAeWEikAShZpp.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 7.2.zTM9EtIGQK.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.2.zTM9EtIGQK.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/4@0/0

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

File created: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6128:120:WilError_01

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

File created: C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp

Jump to behavior

Source: zTM9EtIGQK.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);

Source: zTM9EtIGQK.exe	Virustotal: Detection: 32%
Source: zTM9EtIGQK.exe	ReversingLabs: Detection: 35%

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

File read: C:\Users\user\Desktop\zTM9EtIGQK.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\zTM9EtIGQK.exe 'C:\Users\user\Desktop\zTM9EtIGQK.exe'
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process created: C:\Users\user\Desktop\zTM9EtIGQK.exe C:\Users\user\Desktop\zTM9EtIGQK.exe
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process created: C:\Users\user\Desktop\zTM9EtIGQK.exe C:\Users\user\Desktop\zTM9EtIGQK.exe	Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: zTM9EtIGQK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: zTM9EtIGQK.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 0_2_06DD2D17 push es; ret	0_2_06DD2D18
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_01437A37 push edi; retn 0000h	7_2_01437A39
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_02EADCCE push 8BF08BFEh; iretd	7_2_02EADCDF
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Code function: 7_2_02EADD38 push FFFFFF8Bh; iretd	7_2_02EADD3B

Source: initial sample	Static PE information: section name: .text entropy: 7.59937504831
Source: initial sample	Static PE information: section name: .text entropy: 7.59937504831

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

File created: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp'

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zTM9EtIGQK.exe PID: 2996, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Window / User API: threadDelayed 3165			Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Window / User API: threadDelayed 6686			Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe TID: 968	Thread sleep time: -103140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe TID: 4772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe TID: 6196	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe TID: 6200	Thread sleep count: 3165 > 30	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe TID: 6200	Thread sleep count: 6686 > 30	Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Thread delayed: delay time: 103140	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllWe
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe

Memory written: C:\Users\user\Desktop\zTM9EtIGQK.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Process created: C:\Users\user\Desktop\zTM9EtIGQK.exe C:\Users\user\Desktop\zTM9EtIGQK.exe			Jump to behavior

Source: zTM9EtIGQK.exe, 00000007.00000002.490377339.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: zTM9EtIGQK.exe, 00000007.00000002.490377339.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: zTM9EtIGQK.exe, 00000007.00000002.490377339.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: zTM9EtIGQK.exe, 00000007.00000002.490377339.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Users\user\Desktop\zTM9EtIGQK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zTM9EtIGQK.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report zTM9EtIGQK.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection: