Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report zTM9EtIGQK.exe

Overview

General Information

Sample Name:zTM9EtIGQK.exe
Analysis ID:383945
MD5:01158bfc4ce6cb2c5a3cdbf661f13f8b
SHA1:4d18044e5cfa5ebb9b397dd742648db870b1f32a
SHA256:4ee443331bdebfdfffa8f7fe75c1434504a900dc792561390f27c3f9f0c8bc09
Tags:AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • zTM9EtIGQK.exe (PID: 2996 cmdline: 'C:\Users\user\Desktop\zTM9EtIGQK.exe' MD5: 01158BFC4CE6CB2C5A3CDBF661F13F8B)
    • schtasks.exe (PID: 5852 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • zTM9EtIGQK.exe (PID: 4864 cmdline: C:\Users\user\Desktop\zTM9EtIGQK.exe MD5: 01158BFC4CE6CB2C5A3CDBF661F13F8B)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "armyscheme3@yandex.combrowse9jasmtp.yandex.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000007.00000002.483950823.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          00000000.00000002.262469777.0000000003581000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.zTM9EtIGQK.exe.36231a0.2.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              7.2.zTM9EtIGQK.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                0.2.zTM9EtIGQK.exe.36231a0.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

                  Sigma Overview

                  System Summary:

                  barindex
                  Sigma detected: Scheduled temp file as task from temp locationShow sources
                  Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\zTM9EtIGQK.exe' , ParentImage: C:\Users\user\Desktop\zTM9EtIGQK.exe, ParentProcessId: 2996, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp', ProcessId: 5852

                  Signature Overview

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection:

                  barindex
                  Antivirus / Scanner detection for submitted sampleShow sources
                  Source: zTM9EtIGQK.exeAvira: detected
                  Antivirus detection for dropped fileShow sources
                  Source: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exeAvira: detection malicious, Label: HEUR/AGEN.1138557
                  Found malware configurationShow sources
                  Source: 0.2.zTM9EtIGQK.exe.36231a0.2.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "armyscheme3@yandex.combrowse9jasmtp.yandex.com"}
                  Multi AV Scanner detection for dropped fileShow sources
                  Source: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exeReversingLabs: Detection: 35%
                  Multi AV Scanner detection for submitted fileShow sources
                  Source: zTM9EtIGQK.exeVirustotal: Detection: 32%Perma Link
                  Source: zTM9EtIGQK.exeReversingLabs: Detection: 35%
                  Machine Learning detection for dropped fileShow sources
                  Source: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exeJoe Sandbox ML: detected
                  Machine Learning detection for sampleShow sources
                  Source: zTM9EtIGQK.exeJoe Sandbox ML: detected
                  Source: 7.2.zTM9EtIGQK.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                  Source: zTM9EtIGQK.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                  Source: zTM9EtIGQK.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpString found in binary or memory: http://NmvONo.com
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://crl.certum.pl/ca.crl0h
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://repository.certum.pl/ca.cer09
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://repository.certum.pl/ycasha2.cer0
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261724513.00000000024C1000.00000004.00000001.sdmp, zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
                  Source: zTM9EtIGQK.exe, 00000007.00000002.494240674.0000000003314000.00000004.00000001.sdmpString found in binary or memory: http://smtp.yandex.com
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://subca.ocsp-certum.com0.
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
                  Source: zTM9EtIGQK.exeString found in binary or memory: http://tempuri.org/GridOneHSDataSet.xsd
                  Source: zTM9EtIGQK.exeString found in binary or memory: http://tempuri.org/HighScoresDataSet.xsd
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://www.certum.pl/CPS0
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261241887.0000000000C07000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comicta
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261241887.0000000000C07000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comm
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                  Source: zTM9EtIGQK.exe, 00000000.00000003.219533614.00000000054EB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comHC
                  Source: zTM9EtIGQK.exe, 00000000.00000003.219397829.00000000054EB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com~C
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                  Source: zTM9EtIGQK.exe, 00000000.00000003.221443733.00000000054E1000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnE
                  Source: zTM9EtIGQK.exe, 00000000.00000003.221443733.00000000054E1000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnd
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                  Source: zTM9EtIGQK.exe, 00000000.00000003.219814071.00000000054EB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comZC
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: http://yandex.ocsp-responder.com03
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp, zTM9EtIGQK.exe, 00000007.00000002.494359087.0000000003340000.00000004.00000001.sdmpString found in binary or memory: https://K7p4S11uSBScHXT6.com
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpString found in binary or memory: https://www.certum.pl/CPS0
                  Source: zTM9EtIGQK.exe, 00000000.00000002.262469777.0000000003581000.00000004.00000001.sdmp, zTM9EtIGQK.exe, 00000007.00000002.483950823.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                  System Summary:

                  barindex
                  .NET source code contains very large array initializationsShow sources
                  Source: 7.2.zTM9EtIGQK.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b9BB50ABBu002d997Bu002d49D4u002d96BAu002dB4F190B3376Fu007d/u0036183AC38u002d4AD0u002d4B11u002d886Du002d06E3B37F3CC0.csLarge array initialization: .cctor: array initializer size 11951
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD6EA8 NtQueryInformationProcess,
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD6EA0 NtQueryInformationProcess,
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_000FA9EA
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_0235C2B0
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_02359990
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD54C0
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD6C60
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DDC420
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD7A78
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DDCB00
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DDD130
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD8650
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD8660
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD7FD9
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD7FE8
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD5768
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD54B0
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD6459
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD6468
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD5D88
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD7D84
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD2DB0
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD2DAE
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD5D4C
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD2258
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD7A5B
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD2268
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD7A1F
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD1B88
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD1B78
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD9318
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD9308
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD08F8
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD2053
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD9818
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD9807
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD2038
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD2028
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD0908
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_0E6D2B88
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_0E6D1860
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_000FAAC7
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_000FAA54
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_00CEA9EA
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_01432D50
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_01432020
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_0143AB70
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_01432618
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_0143B110
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_0143D980
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_0143BDBC
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_0143EE10
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_02EA46A0
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_02EA4690
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_02EA4672
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_05B97540
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_05B994F8
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_05B96C70
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_05B96928
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_00CEAAC7
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_00CEAA54
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_05B9257B
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_05B92680
                  Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe 4EE443331BDEBFDFFFA8F7FE75C1434504A900DC792561390F27C3F9F0C8BC09
                  Source: zTM9EtIGQK.exeBinary or memory string: OriginalFilename vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000000.00000002.270432002.000000000E3D0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000000.00000002.270432002.000000000E3D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameZLGbMGFFseWUKMCXRuKzK.exe4 vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll2 vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000000.00000002.267978645.0000000006D40000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll" vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000000.00000003.258888468.000000000DB66000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameFilter.exe4 vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000000.00000002.268399680.00000000083F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000000.00000002.269700084.000000000E2D0000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exeBinary or memory string: OriginalFilename vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000007.00000000.257991876.0000000000CE2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameFilter.exe4 vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000007.00000002.483950823.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameZLGbMGFFseWUKMCXRuKzK.exe4 vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000007.00000002.498895022.0000000006580000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489837671.00000000014A0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exeBinary or memory string: OriginalFilenameFilter.exe4 vs zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                  Source: zTM9EtIGQK.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: VKAeWEikAShZpp.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: 7.2.zTM9EtIGQK.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: 7.2.zTM9EtIGQK.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/4@0/0
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile created: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exeJump to behavior
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6128:120:WilError_01
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile created: C:\Users\user\AppData\Local\Temp\tmp7D9A.tmpJump to behavior
                  Source: zTM9EtIGQK.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
                  Source: zTM9EtIGQK.exeVirustotal: Detection: 32%
                  Source: zTM9EtIGQK.exeReversingLabs: Detection: 35%
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile read: C:\Users\user\Desktop\zTM9EtIGQK.exeJump to behavior
                  Source: unknownProcess created: C:\Users\user\Desktop\zTM9EtIGQK.exe 'C:\Users\user\Desktop\zTM9EtIGQK.exe'
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp'
                  Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess created: C:\Users\user\Desktop\zTM9EtIGQK.exe C:\Users\user\Desktop\zTM9EtIGQK.exe
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp'
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess created: C:\Users\user\Desktop\zTM9EtIGQK.exe C:\Users\user\Desktop\zTM9EtIGQK.exe
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                  Source: zTM9EtIGQK.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: zTM9EtIGQK.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 0_2_06DD2D17 push es; ret
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_01437A37 push edi; retn 0000h
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_02EADCCE push 8BF08BFEh; iretd
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeCode function: 7_2_02EADD38 push FFFFFF8Bh; iretd
                  Source: initial sampleStatic PE information: section name: .text entropy: 7.59937504831
                  Source: initial sampleStatic PE information: section name: .text entropy: 7.59937504831
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile created: C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exeJump to dropped file

                  Boot Survival:

                  barindex
                  Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp'
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information set: NOOPENFILEERRORBOX

                  Malware Analysis System Evasion:

                  barindex
                  Yara detected AntiVM3Show sources
                  Source: Yara matchFile source: 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: zTM9EtIGQK.exe PID: 2996, type: MEMORY
                  Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                  Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                  Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeWindow / User API: threadDelayed 3165
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeWindow / User API: threadDelayed 6686
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exe TID: 968Thread sleep time: -103140s >= -30000s
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exe TID: 4772Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exe TID: 6196Thread sleep time: -18446744073709540s >= -30000s
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exe TID: 6200Thread sleep count: 3165 > 30
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exe TID: 6200Thread sleep count: 6686 > 30
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeThread delayed: delay time: 103140
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeThread delayed: delay time: 922337203685477
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: vmware
                  Source: zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllWe
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: VMWARE
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                  Source: zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess information queried: ProcessInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess token adjusted: Debug
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess token adjusted: Debug
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeMemory allocated: page read and write | page guard

                  HIPS / PFW / Operating System Protection Evasion:

                  barindex
                  Injects a PE file into a foreign processesShow sources
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeMemory written: C:\Users\user\Desktop\zTM9EtIGQK.exe base: 400000 value starts with: 4D5A
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp'
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeProcess created: C:\Users\user\Desktop\zTM9EtIGQK.exe C:\Users\user\Desktop\zTM9EtIGQK.exe
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490377339.0000000001A20000.00000002.00000001.sdmpBinary or memory string: Program Manager
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490377339.0000000001A20000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490377339.0000000001A20000.00000002.00000001.sdmpBinary or memory string: Progman
                  Source: zTM9EtIGQK.exe, 00000007.00000002.490377339.0000000001A20000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Users\user\Desktop\zTM9EtIGQK.exe VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Users\user\Desktop\zTM9EtIGQK.exe VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                  Stealing of Sensitive Information:

                  barindex
                  Yara detected AgentTeslaShow sources
                  Source: Yara matchFile source: 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000007.00000002.483950823.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.262469777.0000000003581000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: zTM9EtIGQK.exe PID: 4864, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: zTM9EtIGQK.exe PID: 2996, type: MEMORY
                  Source: Yara matchFile source: 0.2.zTM9EtIGQK.exe.36231a0.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 7.2.zTM9EtIGQK.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.zTM9EtIGQK.exe.36231a0.2.raw.unpack, type: UNPACKEDPE
                  Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                  Tries to harvest and steal browser information (history, passwords, etc)Show sources
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                  Tries to harvest and steal ftp login credentialsShow sources
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                  Tries to steal Mail credentials (via file access)Show sources
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                  Source: C:\Users\user\Desktop\zTM9EtIGQK.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                  Source: Yara matchFile source: 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: zTM9EtIGQK.exe PID: 4864, type: MEMORY

                  Remote Access Functionality:

                  barindex
                  Yara detected AgentTeslaShow sources
                  Source: Yara matchFile source: 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000007.00000002.483950823.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.262469777.0000000003581000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: zTM9EtIGQK.exe PID: 4864, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: zTM9EtIGQK.exe PID: 2996, type: MEMORY
                  Source: Yara matchFile source: 0.2.zTM9EtIGQK.exe.36231a0.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 7.2.zTM9EtIGQK.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.zTM9EtIGQK.exe.36231a0.2.raw.unpack, type: UNPACKEDPE

                  Mitre Att&ck Matrix

                  Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                  Valid AccountsWindows Management Instrumentation211Scheduled Task/Job1Process Injection112Masquerading1OS Credential Dumping2Query Registry1Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                  Default AccountsScheduled Task/Job1Boot or Logon Initialization ScriptsScheduled Task/Job1Disable or Modify Tools1Credentials in Registry1Security Software Discovery321Remote Desktop ProtocolArchive Collected Data11Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                  Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion141Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Local System2Automated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                  Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSVirtualization/Sandbox Evasion141Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                  Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                  Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information3Cached Domain CredentialsFile and Directory Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                  External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncSystem Information Discovery114Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 signatures2 2 Behavior Graph ID: 383945 Sample: zTM9EtIGQK.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 26 Found malware configuration 2->26 28 Antivirus detection for dropped file 2->28 30 Antivirus / Scanner detection for submitted sample 2->30 32 9 other signatures 2->32 7 zTM9EtIGQK.exe 7 2->7         started        process3 file4 18 C:\Users\user\AppData\...\VKAeWEikAShZpp.exe, PE32 7->18 dropped 20 C:\...\VKAeWEikAShZpp.exe:Zone.Identifier, ASCII 7->20 dropped 22 C:\Users\user\AppData\Local\...\tmp7D9A.tmp, XML 7->22 dropped 24 C:\Users\user\AppData\...\zTM9EtIGQK.exe.log, ASCII 7->24 dropped 34 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->34 36 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->36 38 Uses schtasks.exe or at.exe to add and modify task schedules 7->38 40 Injects a PE file into a foreign processes 7->40 11 zTM9EtIGQK.exe 2 7->11         started        14 schtasks.exe 1 7->14         started        signatures5 process6 signatures7 42 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->42 44 Tries to steal Mail credentials (via file access) 11->44 46 Tries to harvest and steal ftp login credentials 11->46 48 Tries to harvest and steal browser information (history, passwords, etc) 11->48 16 conhost.exe 14->16         started        process8

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  zTM9EtIGQK.exe32%VirustotalBrowse
                  zTM9EtIGQK.exe35%ReversingLabsWin32.Trojan.AgentTesla
                  zTM9EtIGQK.exe100%AviraHEUR/AGEN.1138557
                  zTM9EtIGQK.exe100%Joe Sandbox ML

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe100%AviraHEUR/AGEN.1138557
                  C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe100%Joe Sandbox ML
                  C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe35%ReversingLabsWin32.Trojan.AgentTesla

                  Unpacked PE Files

                  SourceDetectionScannerLabelLinkDownload
                  0.0.zTM9EtIGQK.exe.f0000.0.unpack100%AviraHEUR/AGEN.1138557Download File
                  7.0.zTM9EtIGQK.exe.ce0000.0.unpack100%AviraHEUR/AGEN.1138557Download File
                  7.2.zTM9EtIGQK.exe.ce0000.1.unpack100%AviraHEUR/AGEN.1138557Download File
                  0.2.zTM9EtIGQK.exe.f0000.0.unpack100%AviraHEUR/AGEN.1138557Download File
                  7.2.zTM9EtIGQK.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                  Domains

                  No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                  https://K7p4S11uSBScHXT6.com0%Avira URL Cloudsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://tempuri.org/GridOneHSDataSet.xsd0%Avira URL Cloudsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.founder.com.cn/cnE0%Avira URL Cloudsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://subca.ocsp-certum.com0.0%URL Reputationsafe
                  http://subca.ocsp-certum.com0.0%URL Reputationsafe
                  http://subca.ocsp-certum.com0.0%URL Reputationsafe
                  http://subca.ocsp-certum.com0.0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://subca.ocsp-certum.com010%URL Reputationsafe
                  http://subca.ocsp-certum.com010%URL Reputationsafe
                  http://subca.ocsp-certum.com010%URL Reputationsafe
                  http://subca.ocsp-certum.com010%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  https://api.ipify.org%0%URL Reputationsafe
                  https://api.ipify.org%0%URL Reputationsafe
                  https://api.ipify.org%0%URL Reputationsafe
                  https://api.ipify.org%0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  http://NmvONo.com0%Avira URL Cloudsafe
                  http://www.founder.com.cn/cnd0%URL Reputationsafe
                  http://www.founder.com.cn/cnd0%URL Reputationsafe
                  http://www.founder.com.cn/cnd0%URL Reputationsafe
                  http://tempuri.org/HighScoresDataSet.xsd0%Avira URL Cloudsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://www.fonts.comHC0%Avira URL Cloudsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  http://www.fontbureau.comicta0%Avira URL Cloudsafe
                  http://www.carterandcone.coml0%URL Reputationsafe
                  http://www.carterandcone.coml0%URL Reputationsafe
                  http://www.carterandcone.coml0%URL Reputationsafe
                  http://yandex.ocsp-responder.com030%URL Reputationsafe
                  http://yandex.ocsp-responder.com030%URL Reputationsafe
                  http://yandex.ocsp-responder.com030%URL Reputationsafe
                  http://www.fonts.com~C0%Avira URL Cloudsafe
                  http://www.founder.com.cn/cn0%URL Reputationsafe
                  http://www.founder.com.cn/cn0%URL Reputationsafe
                  http://www.founder.com.cn/cn0%URL Reputationsafe
                  http://www.tiro.comZC0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  No contacted domains info

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://127.0.0.1:HTTP/1.1zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpfalse
                  • Avira URL Cloud: safe
                  		low
                  http://www.fontbureau.com/designersGzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                    		high
                    https://K7p4S11uSBScHXT6.comzTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp, zTM9EtIGQK.exe, 00000007.00000002.494359087.0000000003340000.00000004.00000001.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.fontbureau.com/designers/?zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                      		high
                      http://www.founder.com.cn/cn/bThezTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.fontbureau.com/designers?zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                        		high
                        http://yandex.crl.certum.pl/ycasha2.crl0qzTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                          		high
                          http://tempuri.org/GridOneHSDataSet.xsdzTM9EtIGQK.exefalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpfalse
                            		high
                            http://www.tiro.comzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designerszTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                              		high
                              http://www.goodfont.co.krzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.csszTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpfalse
                                		high
                                http://www.founder.com.cn/cnEzTM9EtIGQK.exe, 00000000.00000003.221443733.00000000054E1000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.sajatypeworks.comzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://subca.ocsp-certum.com0.zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.typography.netDzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://repository.certum.pl/ca.cer09zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                  		high
                                  http://www.founder.com.cn/cn/cThezTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.galapagosdesign.com/staff/dennis.htmzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://fontfabrik.comzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://subca.ocsp-certum.com01zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.galapagosdesign.com/DPleasezTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  https://api.ipify.org%GETMozilla/5.0zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		low
                                  http://www.fonts.comzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                    		high
                                    http://www.sandoll.co.krzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.urwpp.deDPleasezTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.zhongyicts.com.cnzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namezTM9EtIGQK.exe, 00000000.00000002.261724513.00000000024C1000.00000004.00000001.sdmp, zTM9EtIGQK.exe, 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmpfalse
                                      		high
                                      http://www.sakkal.comzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      https://api.ipify.org%zTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		low
                                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipzTM9EtIGQK.exe, 00000000.00000002.262469777.0000000003581000.00000004.00000001.sdmp, zTM9EtIGQK.exe, 00000007.00000002.483950823.0000000000402000.00000040.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.certum.pl/CPS0zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                        		high
                                        http://NmvONo.comzTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://repository.certum.pl/ycasha2.cer0zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                          		high
                                          http://www.founder.com.cn/cndzTM9EtIGQK.exe, 00000000.00000003.221443733.00000000054E1000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://tempuri.org/HighScoresDataSet.xsdzTM9EtIGQK.exefalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.apache.org/licenses/LICENSE-2.0zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                            		high
                                            http://www.fontbureau.comzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                              		high
                                              http://DynDns.comDynDNSzTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              http://repository.certum.pl/ctnca.cer09zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                                		high
                                                http://www.fonts.comHCzTM9EtIGQK.exe, 00000000.00000003.219533614.00000000054EB000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%hazTM9EtIGQK.exe, 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                		unknown
                                                http://crl.certum.pl/ctnca.crl0kzTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                                  		high
                                                  http://www.fontbureau.comictazTM9EtIGQK.exe, 00000000.00000002.261241887.0000000000C07000.00000004.00000040.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://www.certum.pl/CPS0zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                                    		high
                                                    http://smtp.yandex.comzTM9EtIGQK.exe, 00000007.00000002.494240674.0000000003314000.00000004.00000001.sdmpfalse
                                                      		high
                                                      http://www.carterandcone.comlzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://yandex.ocsp-responder.com03zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.fonts.com~CzTM9EtIGQK.exe, 00000000.00000003.219397829.00000000054EB000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		low
                                                      http://www.fontbureau.com/designers/cabarga.htmlNzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                                        		high
                                                        http://www.founder.com.cn/cnzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.fontbureau.com/designers/frere-jones.htmlzTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                                          		high
                                                          http://www.tiro.comZCzTM9EtIGQK.exe, 00000000.00000003.219814071.00000000054EB000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://crls.yandex.net/certum/ycasha2.crl0-zTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                                            		high
                                                            http://www.fontbureau.commzTM9EtIGQK.exe, 00000000.00000002.261241887.0000000000C07000.00000004.00000040.sdmpfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://www.jiyu-kobo.co.jp/zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://www.fontbureau.com/designers8zTM9EtIGQK.exe, 00000000.00000002.267658115.00000000066E2000.00000004.00000001.sdmpfalse
                                                              		high
                                                              http://crl.certum.pl/ca.crl0hzTM9EtIGQK.exe, 00000007.00000002.489237236.0000000001385000.00000004.00000020.sdmpfalse
                                                                		high

                                                                Contacted IPs

                                                                No contacted IP infos

                                                                General Information

                                                                Joe Sandbox Version:31.0.0 Emerald
                                                                Analysis ID:383945
                                                                Start date:08.04.2021
                                                                Start time:12:55:30
                                                                Joe Sandbox Product:CloudBasic
                                                                Overall analysis duration:0h 9m 28s
                                                                Hypervisor based Inspection enabled:false
                                                                Report type:light
                                                                Sample file name:zTM9EtIGQK.exe
                                                                Cookbook file name:default.jbs
                                                                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                Number of analysed new started processes analysed:30
                                                                Number of new started drivers analysed:0
                                                                Number of existing processes analysed:0
                                                                Number of existing drivers analysed:0
                                                                Number of injected processes analysed:0
                                                                Technologies:
                                                                • HCA enabled
                                                                • EGA enabled
                                                                • HDC enabled
                                                                • AMSI enabled
                                                                Analysis Mode:default
                                                                Analysis stop reason:Timeout
                                                                Detection:MAL
                                                                Classification:mal100.troj.spyw.evad.winEXE@6/4@0/0
                                                                EGA Information:Failed
                                                                HDC Information:Failed
                                                                HCA Information:
                                                                • Successful, ratio: 94%
                                                                • Number of executed functions: 0
                                                                • Number of non-executed functions: 0
                                                                Cookbook Comments:
                                                                • Adjust boot time
                                                                • Enable AMSI
                                                                • Found application associated with file extension: .exe
                                                                Warnings:
                                                                Show All
                                                                • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe
                                                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                • Report size getting too big, too many NtQueryValueKey calls found.

                                                                Simulations

                                                                Behavior and APIs

                                                                TimeTypeDescription
                                                                12:56:29API Interceptor636x Sleep call for process: zTM9EtIGQK.exe modified

                                                                Joe Sandbox View / Context

                                                                IPs

                                                                No context

                                                                Domains

                                                                No context

                                                                ASN

                                                                No context

                                                                JA3 Fingerprints

                                                                No context

                                                                Dropped Files

                                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exeAL JUNEIDI LIST.xlsxGet hashmaliciousBrowse

                                                                  Created / dropped Files

                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zTM9EtIGQK.exe.log
                                                                  Process:C:\Users\user\Desktop\zTM9EtIGQK.exe
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:modified
                                                                  Size (bytes):1314
                                                                  Entropy (8bit):5.350128552078965
                                                                  Encrypted:false
                                                                  SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
                                                                  MD5:1DC1A2DCC9EFAA84EABF4F6D6066565B
                                                                  SHA1:B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
                                                                  SHA-256:28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
                                                                  SHA-512:95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
                                                                  Malicious:true
                                                                  Reputation:high, very likely benign file
                                                                  Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a
                                                                  C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp
                                                                  Process:C:\Users\user\Desktop\zTM9EtIGQK.exe
                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):1647
                                                                  Entropy (8bit):5.197410812561367
                                                                  Encrypted:false
                                                                  SSDEEP:24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBStn:cbh47TlNQ//rydbz9I3YODOLNdq3O
                                                                  MD5:8C4E6C1F3629B50562C2774FC2B995AA
                                                                  SHA1:4A9060EC41D0F6E5BB00B7B6194AD82AFA9BAAA0
                                                                  SHA-256:C29A2FA4BE2912DAE590F96535F35D508898BFBCF7824CD32F331B1CF12DA2D5
                                                                  SHA-512:AB8EB6008B836B5691630ACA8C62286722ABD5FC03DB67A30B2522AC945EC5AFF1039FE87B17211AD59ED4C79923CFE19177C2A802874AADBAEE47C807853711
                                                                  Malicious:true
                                                                  Reputation:low
                                                                  Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                                                  C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe
                                                                  Process:C:\Users\user\Desktop\zTM9EtIGQK.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):649728
                                                                  Entropy (8bit):7.589549958297263
                                                                  Encrypted:false
                                                                  SSDEEP:12288:9z54oxOwaGspLEPkLhHICpVazP9czBBo2OjKTe2/WQI6xfm:9z5GwupWkLdpGP9AYKThWQXxf
                                                                  MD5:01158BFC4CE6CB2C5A3CDBF661F13F8B
                                                                  SHA1:4D18044E5CFA5EBB9B397DD742648DB870B1F32A
                                                                  SHA-256:4EE443331BDEBFDFFFA8F7FE75C1434504A900DC792561390F27C3F9F0C8BC09
                                                                  SHA-512:D07D372E5399FDF8D95117D7D8F33CF3AFD75ABDC8C7BF812EECB18F73AC25D30E599AF11403B9621072435C18DB812A1EA0577792345BBF9C9381D0A213B98E
                                                                  Malicious:true
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 35%
                                                                  Joe Sandbox View:
                                                                  • Filename: AL JUNEIDI LIST.xlsx, Detection: malicious, Browse
                                                                  Reputation:low
                                                                  Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Vn`..............P.............f.... ........@.. .......................@............@.....................................O............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................H.......H.......|...Xo..............@............................................0............(,...(-.........(.....o.....*.....................(/......(0......(1......(2......(3....*N..(....oK...(4....*&..(5....*.s6........s7........s8........s9........s:........*....0...........~....o;....+..*.0...........~....o<....+..*.0...........~....o=....+..*.0...........~....o>....+..*.0...........~....o?....+..*&..(@....*...0..<........~.....(A.....,!r...p.....(B...oC...sD............~.....
                                                                  C:\Users\user\AppData\Roaming\VKAeWEikAShZpp.exe:Zone.Identifier
                                                                  Process:C:\Users\user\Desktop\zTM9EtIGQK.exe
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:dropped
                                                                  Size (bytes):26
                                                                  Entropy (8bit):3.95006375643621
                                                                  Encrypted:false
                                                                  SSDEEP:3:ggPYV:rPYV
                                                                  MD5:187F488E27DB4AF347237FE461A079AD
                                                                  SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                  SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                  SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                  Malicious:true
                                                                  Reputation:high, very likely benign file
                                                                  Preview: [ZoneTransfer]....ZoneId=0

                                                                  Static File Info

                                                                  General

                                                                  File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                  Entropy (8bit):7.589549958297263
                                                                  TrID:
                                                                  • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                  • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                  • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                  • Windows Screen Saver (13104/52) 0.07%
                                                                  • Generic Win/DOS Executable (2004/3) 0.01%
                                                                  File name:zTM9EtIGQK.exe
                                                                  File size:649728
                                                                  MD5:01158bfc4ce6cb2c5a3cdbf661f13f8b
                                                                  SHA1:4d18044e5cfa5ebb9b397dd742648db870b1f32a
                                                                  SHA256:4ee443331bdebfdfffa8f7fe75c1434504a900dc792561390f27c3f9f0c8bc09
                                                                  SHA512:d07d372e5399fdf8d95117d7d8f33cf3afd75abdc8c7bf812eecb18f73ac25d30e599af11403b9621072435c18db812a1ea0577792345bbf9c9381d0a213b98e
                                                                  SSDEEP:12288:9z54oxOwaGspLEPkLhHICpVazP9czBBo2OjKTe2/WQI6xfm:9z5GwupWkLdpGP9AYKThWQXxf
                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Vn`..............P.............f.... ........@.. .......................@............@................................

                                                                  File Icon

                                                                  Icon Hash:00828e8e8686b000

                                                                  Static PE Info

                                                                  General

                                                                  Entrypoint:0x49fa66
                                                                  Entrypoint Section:.text
                                                                  Digitally signed:false
                                                                  Imagebase:0x400000
                                                                  Subsystem:windows gui
                                                                  Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                                  DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                  Time Stamp:0x606E5614 [Thu Apr 8 01:02:12 2021 UTC]
                                                                  TLS Callbacks:
                                                                  CLR (.Net) Version:v4.0.30319
                                                                  OS Version Major:4
                                                                  OS Version Minor:0
                                                                  File Version Major:4
                                                                  File Version Minor:0
                                                                  Subsystem Version Major:4
                                                                  Subsystem Version Minor:0
                                                                  Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                  Entrypoint Preview

                                                                  Instruction
                                                                  jmp dword ptr [00402000h]
                                                                  add dword ptr [eax], eax
                                                                  add byte ptr [eax], al
                                                                  add al, byte ptr [eax]
                                                                  add byte ptr [eax], al
                                                                  or byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  or eax, 0C000000h
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax+eax], al
                                                                  add byte ptr [eax], al
                                                                  pop es
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [esi], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [edx], cl
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [esi], cl
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], cl
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax+eax], cl
                                                                  add byte ptr [eax], al
                                                                  push cs
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [esi], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [esi], cl
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [ecx], cl
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], cl
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [ebx], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [esi], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax+eax], al
                                                                  add byte ptr [eax], al
                                                                  pop es
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax+eax], cl
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add al, byte ptr [eax]
                                                                  add byte ptr [eax], al
                                                                  push es
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [edx], cl
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax+eax], al
                                                                  add byte ptr [eax], al
                                                                  or al, byte ptr [eax]
                                                                  add byte ptr [eax], al
                                                                  push cs
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [ecx], cl
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax+eax], cl
                                                                  add byte ptr [eax], al
                                                                  add eax, 00000000h
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [ebx], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [eax+eax], al
                                                                  add byte ptr [eax], al
                                                                  or eax, dword ptr [eax]
                                                                  add byte ptr [eax], al
                                                                  or eax, dword ptr [eax]
                                                                  add byte ptr [eax], al
                                                                  or al, 00h
                                                                  add byte ptr [eax], al
                                                                  or eax, 02000000h
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [ecx], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [edx], al
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [esi], cl
                                                                  add byte ptr [eax], al
                                                                  add byte ptr [00000000h], al

                                                                  Data Directories

                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x9fa140x4f.text
                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xa00000x5a4.rsrc
                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0xa20000xc.reloc
                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                  Sections

                                                                  NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                  .text0x20000x9df9c0x9e000False0.776166312302data7.59937504831IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                  .rsrc0xa00000x5a40x600False0.416666666667data4.04558430369IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                  .reloc0xa20000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                  Resources

                                                                  NameRVASizeTypeLanguageCountry
                                                                  RT_VERSION0xa00900x314data
                                                                  RT_MANIFEST0xa03b40x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                  Imports

                                                                  DLLImport
                                                                  mscoree.dll_CorExeMain

                                                                  Version Infos

                                                                  DescriptionData
                                                                  Translation0x0000 0x04b0
                                                                  LegalCopyrightCopyright 2015
                                                                  Assembly Version1.0.0.0
                                                                  InternalNameFilter.exe
                                                                  FileVersion1.0.0.0
                                                                  CompanyName
                                                                  LegalTrademarks
                                                                  Comments
                                                                  ProductNameCodewords
                                                                  ProductVersion1.0.0.0
                                                                  FileDescriptionCodewords
                                                                  OriginalFilenameFilter.exe

                                                                  Network Behavior

                                                                  No network behavior found

                                                                  Code Manipulations

                                                                  Statistics

                                                                  Behavior

                                                                  Click to jump to process

                                                                  System Behavior

                                                                  Analysis Process: zTM9EtIGQK.exe PID: 2996 Parent PID: 5708

                                                                  General

                                                                  Start time:12:56:23
                                                                  Start date:08/04/2021
                                                                  Path:C:\Users\user\Desktop\zTM9EtIGQK.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:'C:\Users\user\Desktop\zTM9EtIGQK.exe'
                                                                  Imagebase:0xf0000
                                                                  File size:649728 bytes
                                                                  MD5 hash:01158BFC4CE6CB2C5A3CDBF661F13F8B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:.Net C# or VB.NET
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.261761814.00000000024D3000.00000004.00000001.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.262469777.0000000003581000.00000004.00000001.sdmp, Author: Joe Security
                                                                  Reputation:low

                                                                  Analysis Process: schtasks.exe PID: 5852 Parent PID: 2996

                                                                  General

                                                                  Start time:12:56:42
                                                                  Start date:08/04/2021
                                                                  Path:C:\Windows\SysWOW64\schtasks.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\VKAeWEikAShZpp' /XML 'C:\Users\user\AppData\Local\Temp\tmp7D9A.tmp'
                                                                  Imagebase:0x810000
                                                                  File size:185856 bytes
                                                                  MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high

                                                                  Analysis Process: conhost.exe PID: 6128 Parent PID: 5852

                                                                  General

                                                                  Start time:12:56:42
                                                                  Start date:08/04/2021
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff6b2800000
                                                                  File size:625664 bytes
                                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high

                                                                  Analysis Process: zTM9EtIGQK.exe PID: 4864 Parent PID: 2996

                                                                  General

                                                                  Start time:12:56:43
                                                                  Start date:08/04/2021
                                                                  Path:C:\Users\user\Desktop\zTM9EtIGQK.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Users\user\Desktop\zTM9EtIGQK.exe
                                                                  Imagebase:0xce0000
                                                                  File size:649728 bytes
                                                                  MD5 hash:01158BFC4CE6CB2C5A3CDBF661F13F8B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:.Net C# or VB.NET
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.490822445.0000000003051000.00000004.00000001.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.483950823.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                  Reputation:low

                                                                  Disassembly

                                                                  Code Analysis

                                                                  Reset < >