Windows Analysis Report 6KdTCZit4e.exe

Overview

General Information

Sample Name: 6KdTCZit4e.exe
Analysis ID: 452425
MD5: ed43ff447cd5486610731a627a930607
SHA1: 91449c85fb2fa5d27f8db3c8c08cdfb9d3287162
SHA256: 91cdb947644a5a802adac7583a79e7e560da38839489a02e7464730ff66fd004
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses netstat to query active network connections and open ports
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.hometowncashbuyersgroup.com/kkt/"], "decoy": ["inspirafutebol.com", "customgiftshouston.com", "mycreativelending.com", "psplaystore.com", "newlivingsolutionshop.com", "dechefamsterdam.com", "servicingl0ans.com", "atsdholdings.com", "manifestarz.com", "sequenceanalytica.com", "gethealthcaresmart.com", "theartofsurprises.com", "pirateequitypatrick.com", "alliance-ce.com", "wingrushusa.com", "funtimespheres.com", "solevux.com", "antimasathya.com", "profitexcavator.com", "lankeboxshop.com", "aarthiramamurthy.com", "oldmopaiv.xyz", "mavispaguzellik.com", "milkamax.com", "sputnikvasisi.com", "gametoyou.com", "sisconbol.com", "thedreamcertificate.com", "vichy-menuiserie.com", "pv-step.com", "growingmindstrilingual.com", "tlcrentny.com", "jedshomebuilders.com", "curtailit.com", "integruschamber.com", "lanzamientosbimbocolombia.com", "tightlinesfishingco.com", "doubleuphome.com", "arctic.solar", "unstopabbledomains.com", "aggiornamento-isp.info", "clarkandhurnlaw.com", "barefootbirthstl.com", "seanfeuct.com", "measureformeasurehome.com", "stephsavy.com", "loveflowersandevents.com", "czsis.com", "midnightblueinc.com", "today.dental", "customwithme.com", "edisetiyo.com", "jasoneganrealtor.com", "rihxertiza.com", "seahorseblast.net", "nedayerasa.com", "cliftonheightshoa.net", "theprofilemba.com", "cfwoods.com", "dogggo.com", "casatranquillainletbeach.com", "u1023.com", "aromakapseln.com", "zhwanjie.com"]}
Multi AV Scanner detection for submitted file
Source: 6KdTCZit4e.exe Virustotal: Detection: 38% Perma Link
Source: 6KdTCZit4e.exe ReversingLabs: Detection: 19%
Yara detected FormBook
Source: Yara match File source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY
Antivirus or Machine Learning detection for unpacked file
Source: 7.2.6KdTCZit4e.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: 6KdTCZit4e.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: 6KdTCZit4e.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: netstat.pdbGCTL source: 6KdTCZit4e.exe, 00000007.00000002.797353151.0000000001720000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000008.00000000.741672578.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: netstat.pdb source: 6KdTCZit4e.exe, 00000007.00000002.797353151.0000000001720000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: 6KdTCZit4e.exe, 00000007.00000002.795763283.000000000136F000.00000040.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 6KdTCZit4e.exe, 00000007.00000002.795763283.000000000136F000.00000040.00000001.sdmp, NETSTAT.EXE
Source: Binary string: wscui.pdb source: explorer.exe, 00000008.00000000.741672578.0000000005A00000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 4x nop then pop esi 7_2_004172E0
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 4x nop then pop ebx 7_2_00407B06
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 4x nop then pop edi 7_2_00416C87
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 4x nop then pop esi 13_2_028A72E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 4x nop then pop ebx 13_2_02897B06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 4x nop then pop edi 13_2_028A6C87

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.hometowncashbuyersgroup.com/kkt/
Uses netstat to query active network connections and open ports
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /kkt/?ibQh=6llLiJzHhP5P5Lj&I48l2h=L0B8w9HUZaOZ7jw4+npXJ0F94zqPsX3Vt6n0qHR8lA3J0yAUFnvUFF5QUXy5W701wjCn HTTP/1.1Host: www.thedreamcertificate.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /kkt/?I48l2h=JgCZg0ECNQCGdZh+l8D79i0V4/Xiha033Hwln1gAEXgZOLyx1jBrHFXC3spPC1oi0umv&ibQh=6llLiJzHhP5P5Lj HTTP/1.1Host: www.seahorseblast.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /kkt/?ibQh=6llLiJzHhP5P5Lj&I48l2h=L0B8w9HUZaOZ7jw4+npXJ0F94zqPsX3Vt6n0qHR8lA3J0yAUFnvUFF5QUXy5W701wjCn HTTP/1.1Host: www.thedreamcertificate.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /kkt/?I48l2h=JgCZg0ECNQCGdZh+l8D79i0V4/Xiha033Hwln1gAEXgZOLyx1jBrHFXC3spPC1oi0umv&ibQh=6llLiJzHhP5P5Lj HTTP/1.1Host: www.seahorseblast.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.thedreamcertificate.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 22 Jul 2021 08:35:02 GMTServer: ApacheX-XSS-Protection: 1; mode=blockX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffContent-Length: 202Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6b 6b 74 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /kkt/ was not found on this server.</p></body></html>
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000008.00000000.767736283.0000000002B50000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: 6KdTCZit4e.exe String found in binary or memory: http://www.xboxleaders.com/api/friends.json?gamertag=
Source: 6KdTCZit4e.exe String found in binary or memory: http://www.xboxleaders.com/api/profile.json?gamertag=
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00419D60 NtCreateFile, 7_2_00419D60
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00419E10 NtReadFile, 7_2_00419E10
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00419E90 NtClose, 7_2_00419E90
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00419F40 NtAllocateVirtualMemory, 7_2_00419F40
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00419D5A NtCreateFile, 7_2_00419D5A
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00419E0A NtReadFile, 7_2_00419E0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D696D0 NtCreateKey,LdrInitializeThunk, 13_2_02D696D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D696E0 NtFreeVirtualMemory,LdrInitializeThunk, 13_2_02D696E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69650 NtQueryValueKey,LdrInitializeThunk, 13_2_02D69650
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69A50 NtCreateFile,LdrInitializeThunk, 13_2_02D69A50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69660 NtAllocateVirtualMemory,LdrInitializeThunk, 13_2_02D69660
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69FE0 NtCreateMutant,LdrInitializeThunk, 13_2_02D69FE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69780 NtMapViewOfSection,LdrInitializeThunk, 13_2_02D69780
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69710 NtQueryInformationToken,LdrInitializeThunk, 13_2_02D69710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69840 NtDelayExecution,LdrInitializeThunk, 13_2_02D69840
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69860 NtQuerySystemInformation,LdrInitializeThunk, 13_2_02D69860
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D695D0 NtClose,LdrInitializeThunk, 13_2_02D695D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D699A0 NtCreateSection,LdrInitializeThunk, 13_2_02D699A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69540 NtReadFile,LdrInitializeThunk, 13_2_02D69540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69910 NtAdjustPrivilegesToken,LdrInitializeThunk, 13_2_02D69910
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69A80 NtOpenDirectoryObject, 13_2_02D69A80
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69670 NtQueryInformationProcess, 13_2_02D69670
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69610 NtEnumerateValueKey, 13_2_02D69610
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69A10 NtQuerySection, 13_2_02D69A10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69A00 NtProtectVirtualMemory, 13_2_02D69A00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69A20 NtResumeThread, 13_2_02D69A20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D6A3B0 NtGetContextThread, 13_2_02D6A3B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D697A0 NtUnmapViewOfSection, 13_2_02D697A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69770 NtSetInformationFile, 13_2_02D69770
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D6A770 NtOpenThread, 13_2_02D6A770
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69760 NtOpenProcess, 13_2_02D69760
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D6A710 NtOpenProcessToken, 13_2_02D6A710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69B00 NtSetValueKey, 13_2_02D69B00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69730 NtQueryVirtualMemory, 13_2_02D69730
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D698F0 NtReadVirtualMemory, 13_2_02D698F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D698A0 NtWriteVirtualMemory, 13_2_02D698A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D6B040 NtSuspendThread, 13_2_02D6B040
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69820 NtEnumerateKey, 13_2_02D69820
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D699D0 NtCreateProcessEx, 13_2_02D699D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D695F0 NtQueryInformationFile, 13_2_02D695F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69950 NtQueueApcThread, 13_2_02D69950
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69560 NtWriteFile, 13_2_02D69560
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D6AD30 NtSetContextThread, 13_2_02D6AD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D69520 NtWaitForSingleObject, 13_2_02D69520
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028A9E90 NtClose, 13_2_028A9E90
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028A9E10 NtReadFile, 13_2_028A9E10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028A9F40 NtAllocateVirtualMemory, 13_2_028A9F40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028A9D60 NtCreateFile, 13_2_028A9D60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028A9E0A NtReadFile, 13_2_028A9E0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028A9D5A NtCreateFile, 13_2_028A9D5A
Detected potential crypto function
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041E000 7_2_0041E000
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00401030 7_2_00401030
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041D1AB 7_2_0041D1AB
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041E258 7_2_0041E258
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00401208 7_2_00401208
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041DD7D 7_2_0041DD7D
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00402D87 7_2_00402D87
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00402D90 7_2_00402D90
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00409E40 7_2_00409E40
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00409E3B 7_2_00409E3B
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041DF3E 7_2_0041DF3E
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00402FB0 7_2_00402FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D46E30 13_2_02D46E30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5EBB0 13_2_02D5EBB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3B090 13_2_02D3B090
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3841F 13_2_02D3841F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1002 13_2_02DE1002
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3D5E0 13_2_02D3D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF1D55 13_2_02DF1D55
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2F900 13_2_02D2F900
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D20D20 13_2_02D20D20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D44120 13_2_02D44120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028AE258 13_2_028AE258
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028AE000 13_2_028AE000
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028AD1AB 13_2_028AD1AB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02899E3B 13_2_02899E3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02899E40 13_2_02899E40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02892FB0 13_2_02892FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02892D87 13_2_02892D87
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02892D90 13_2_02892D90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: String function: 02D2B150 appears 32 times
Sample file is different than original file name gathered from version info
Source: 6KdTCZit4e.exe, 00000000.00000000.656062623.000000000080A000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameTimeSpanStyl.exe2 vs 6KdTCZit4e.exe
Source: 6KdTCZit4e.exe, 00000007.00000002.793159947.00000000008CA000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameTimeSpanStyl.exe2 vs 6KdTCZit4e.exe
Source: 6KdTCZit4e.exe, 00000007.00000002.796525668.00000000014FF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 6KdTCZit4e.exe
Source: 6KdTCZit4e.exe, 00000007.00000002.797353151.0000000001720000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamenetstat.exej% vs 6KdTCZit4e.exe
Source: 6KdTCZit4e.exe Binary or memory string: OriginalFilenameTimeSpanStyl.exe2 vs 6KdTCZit4e.exe
Uses 32bit PE files
Source: 6KdTCZit4e.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@2/2
Source: C:\Users\user\Desktop\6KdTCZit4e.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6KdTCZit4e.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6820:120:WilError_01
Source: 6KdTCZit4e.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: 6KdTCZit4e.exe Virustotal: Detection: 38%
Source: 6KdTCZit4e.exe ReversingLabs: Detection: 19%
Source: unknown Process created: C:\Users\user\Desktop\6KdTCZit4e.exe 'C:\Users\user\Desktop\6KdTCZit4e.exe'
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process created: C:\Users\user\Desktop\6KdTCZit4e.exe C:\Users\user\Desktop\6KdTCZit4e.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\6KdTCZit4e.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process created: C:\Users\user\Desktop\6KdTCZit4e.exe C:\Users\user\Desktop\6KdTCZit4e.exe Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\6KdTCZit4e.exe' Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: 6KdTCZit4e.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 6KdTCZit4e.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: 6KdTCZit4e.exe Static file information: File size 1148416 > 1048576
Source: 6KdTCZit4e.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x116a00
Source: 6KdTCZit4e.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: netstat.pdbGCTL source: 6KdTCZit4e.exe, 00000007.00000002.797353151.0000000001720000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000008.00000000.741672578.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: netstat.pdb source: 6KdTCZit4e.exe, 00000007.00000002.797353151.0000000001720000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: 6KdTCZit4e.exe, 00000007.00000002.795763283.000000000136F000.00000040.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 6KdTCZit4e.exe, 00000007.00000002.795763283.000000000136F000.00000040.00000001.sdmp, NETSTAT.EXE
Source: Binary string: wscui.pdb source: explorer.exe, 00000008.00000000.741672578.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041721D push es; ret 7_2_00417232
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_004175DF push ds; iretd 7_2_004175F2
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_004175A0 push ds; iretd 7_2_004175F2
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041B68C pushad ; iretd 7_2_0041B68D
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041CEB5 push eax; ret 7_2_0041CF08
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041CF6C push eax; ret 7_2_0041CF72
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041CF02 push eax; ret 7_2_0041CF08
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0041CF0B push eax; ret 7_2_0041CF72
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D7D0D1 push ecx; ret 13_2_02D7D0E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028A721D push es; ret 13_2_028A7232
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028AB68C pushad ; iretd 13_2_028AB68D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028ACEB5 push eax; ret 13_2_028ACF08
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028ACF0B push eax; ret 13_2_028ACF72
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028ACF02 push eax; ret 13_2_028ACF08
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028ACF6C push eax; ret 13_2_028ACF72
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028A75A0 push ds; iretd 13_2_028A75F2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_028A75DF push ds; iretd 13_2_028A75F2
Source: initial sample Static PE information: section name: .text entropy: 7.05866733506

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x87 0x7E 0xE9
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: 6KdTCZit4e.exe Binary or memory string: WIRESHARK|WIRESHARK.EXE
Source: 6KdTCZit4e.exe Binary or memory string: SKYPE|SKYPE.EXE'FIREFOX|FIREFOX.EXE+BOOTCAMP|BOOTCAMP.EXE/WIRESHARK|WIRESHARK.EXEAPROCESS HACKER|PROCESSHACKER.EXELOAD
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\6KdTCZit4e.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6KdTCZit4e.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 00000000028998E4 second address: 00000000028998EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 0000000002899B5E second address: 0000000002899B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00409A90 rdtsc 7_2_00409A90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\6KdTCZit4e.exe TID: 6572 Thread sleep time: -54990s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe TID: 6620 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6176 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 6680 Thread sleep time: -35000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Thread delayed: delay time: 54990 Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: 6KdTCZit4e.exe Binary or memory string: vmCIYd
Source: explorer.exe, 00000008.00000000.741348182.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000008.00000000.748027302.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.778347337.0000000004710000.00000004.00000001.sdmp Binary or memory string: _VMware_SATA_CD00#5&f
Source: explorer.exe, 00000008.00000000.742728647.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 6KdTCZit4e.exe Binary or memory string: DdUXhZQ[fUE6Ws]YTSk6WLInYD73f[o5QsEYYq{nV]8XY[8XVpEzfoQZd5M[]WMZ][<IgogJD}4pfy]3[3Y5]DL[]}Y4[3Y5]D75esU[\moJezE[TiU[]qET]m8Z\3QqeMU[]K<IgogJD|YJg4E[eyQ3[3Y5]DL6e3Q5\xDjfoUZd5<pfTU6\osp\SQ[]mopg|Y5XlY5Y843[wEjfoUZd5<pfTU6\osp\SQ[e|<pU843[wEjfoQ[YDL[]nopgyMKX3QZ
Source: explorer.exe, 00000008.00000000.748027302.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.748412391.000000000A716000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 00000008.00000000.778347337.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000008.00000000.741348182.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000008.00000000.748412391.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000008.00000000.741348182.00000000058C0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000008.00000000.748506664.000000000A77F000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000008.00000000.741348182.00000000058C0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_00409A90 rdtsc 7_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Code function: 7_2_0040ACD0 LdrLoadDll, 7_2_0040ACD0
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF8ED6 mov eax, dword ptr fs:[00000030h] 13_2_02DF8ED6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D68EC7 mov eax, dword ptr fs:[00000030h] 13_2_02D68EC7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D536CC mov eax, dword ptr fs:[00000030h] 13_2_02D536CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DDFEC0 mov eax, dword ptr fs:[00000030h] 13_2_02DDFEC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D376E2 mov eax, dword ptr fs:[00000030h] 13_2_02D376E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D516E0 mov ecx, dword ptr fs:[00000030h] 13_2_02D516E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5D294 mov eax, dword ptr fs:[00000030h] 13_2_02D5D294
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5D294 mov eax, dword ptr fs:[00000030h] 13_2_02D5D294
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBFE87 mov eax, dword ptr fs:[00000030h] 13_2_02DBFE87
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3AAB0 mov eax, dword ptr fs:[00000030h] 13_2_02D3AAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3AAB0 mov eax, dword ptr fs:[00000030h] 13_2_02D3AAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5FAB0 mov eax, dword ptr fs:[00000030h] 13_2_02D5FAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D252A5 mov eax, dword ptr fs:[00000030h] 13_2_02D252A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D252A5 mov eax, dword ptr fs:[00000030h] 13_2_02D252A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D252A5 mov eax, dword ptr fs:[00000030h] 13_2_02D252A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D252A5 mov eax, dword ptr fs:[00000030h] 13_2_02D252A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D252A5 mov eax, dword ptr fs:[00000030h] 13_2_02D252A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF0EA5 mov eax, dword ptr fs:[00000030h] 13_2_02DF0EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF0EA5 mov eax, dword ptr fs:[00000030h] 13_2_02DF0EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF0EA5 mov eax, dword ptr fs:[00000030h] 13_2_02DF0EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA46A7 mov eax, dword ptr fs:[00000030h] 13_2_02DA46A7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DB4257 mov eax, dword ptr fs:[00000030h] 13_2_02DB4257
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D29240 mov eax, dword ptr fs:[00000030h] 13_2_02D29240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D29240 mov eax, dword ptr fs:[00000030h] 13_2_02D29240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D29240 mov eax, dword ptr fs:[00000030h] 13_2_02D29240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D29240 mov eax, dword ptr fs:[00000030h] 13_2_02D29240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h] 13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h] 13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h] 13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h] 13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h] 13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h] 13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4AE73 mov eax, dword ptr fs:[00000030h] 13_2_02D4AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4AE73 mov eax, dword ptr fs:[00000030h] 13_2_02D4AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4AE73 mov eax, dword ptr fs:[00000030h] 13_2_02D4AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4AE73 mov eax, dword ptr fs:[00000030h] 13_2_02D4AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4AE73 mov eax, dword ptr fs:[00000030h] 13_2_02D4AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D6927A mov eax, dword ptr fs:[00000030h] 13_2_02D6927A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DDB260 mov eax, dword ptr fs:[00000030h] 13_2_02DDB260
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DDB260 mov eax, dword ptr fs:[00000030h] 13_2_02DDB260
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF8A62 mov eax, dword ptr fs:[00000030h] 13_2_02DF8A62
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3766D mov eax, dword ptr fs:[00000030h] 13_2_02D3766D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D43A1C mov eax, dword ptr fs:[00000030h] 13_2_02D43A1C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2C600 mov eax, dword ptr fs:[00000030h] 13_2_02D2C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2C600 mov eax, dword ptr fs:[00000030h] 13_2_02D2C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2C600 mov eax, dword ptr fs:[00000030h] 13_2_02D2C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DDFE3F mov eax, dword ptr fs:[00000030h] 13_2_02DDFE3F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2E620 mov eax, dword ptr fs:[00000030h] 13_2_02D2E620
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D637F5 mov eax, dword ptr fs:[00000030h] 13_2_02D637F5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5B390 mov eax, dword ptr fs:[00000030h] 13_2_02D5B390
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA7794 mov eax, dword ptr fs:[00000030h] 13_2_02DA7794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA7794 mov eax, dword ptr fs:[00000030h] 13_2_02DA7794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA7794 mov eax, dword ptr fs:[00000030h] 13_2_02DA7794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE138A mov eax, dword ptr fs:[00000030h] 13_2_02DE138A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D31B8F mov eax, dword ptr fs:[00000030h] 13_2_02D31B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D31B8F mov eax, dword ptr fs:[00000030h] 13_2_02D31B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DDD380 mov ecx, dword ptr fs:[00000030h] 13_2_02DDD380
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF5BA5 mov eax, dword ptr fs:[00000030h] 13_2_02DF5BA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF8B58 mov eax, dword ptr fs:[00000030h] 13_2_02DF8B58
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2F358 mov eax, dword ptr fs:[00000030h] 13_2_02D2F358
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2DB40 mov eax, dword ptr fs:[00000030h] 13_2_02D2DB40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3EF40 mov eax, dword ptr fs:[00000030h] 13_2_02D3EF40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D53B7A mov eax, dword ptr fs:[00000030h] 13_2_02D53B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D53B7A mov eax, dword ptr fs:[00000030h] 13_2_02D53B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2DB60 mov ecx, dword ptr fs:[00000030h] 13_2_02D2DB60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3FF60 mov eax, dword ptr fs:[00000030h] 13_2_02D3FF60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF8F6A mov eax, dword ptr fs:[00000030h] 13_2_02DF8F6A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE131B mov eax, dword ptr fs:[00000030h] 13_2_02DE131B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBFF10 mov eax, dword ptr fs:[00000030h] 13_2_02DBFF10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBFF10 mov eax, dword ptr fs:[00000030h] 13_2_02DBFF10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF070D mov eax, dword ptr fs:[00000030h] 13_2_02DF070D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF070D mov eax, dword ptr fs:[00000030h] 13_2_02DF070D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5E730 mov eax, dword ptr fs:[00000030h] 13_2_02D5E730
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D24F2E mov eax, dword ptr fs:[00000030h] 13_2_02D24F2E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D24F2E mov eax, dword ptr fs:[00000030h] 13_2_02D24F2E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF8CD6 mov eax, dword ptr fs:[00000030h] 13_2_02DF8CD6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBB8D0 mov eax, dword ptr fs:[00000030h] 13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBB8D0 mov ecx, dword ptr fs:[00000030h] 13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBB8D0 mov eax, dword ptr fs:[00000030h] 13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBB8D0 mov eax, dword ptr fs:[00000030h] 13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBB8D0 mov eax, dword ptr fs:[00000030h] 13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBB8D0 mov eax, dword ptr fs:[00000030h] 13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE14FB mov eax, dword ptr fs:[00000030h] 13_2_02DE14FB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA6CF0 mov eax, dword ptr fs:[00000030h] 13_2_02DA6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA6CF0 mov eax, dword ptr fs:[00000030h] 13_2_02DA6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA6CF0 mov eax, dword ptr fs:[00000030h] 13_2_02DA6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D29080 mov eax, dword ptr fs:[00000030h] 13_2_02D29080
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA3884 mov eax, dword ptr fs:[00000030h] 13_2_02DA3884
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA3884 mov eax, dword ptr fs:[00000030h] 13_2_02DA3884
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5F0BF mov ecx, dword ptr fs:[00000030h] 13_2_02D5F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5F0BF mov eax, dword ptr fs:[00000030h] 13_2_02D5F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5F0BF mov eax, dword ptr fs:[00000030h] 13_2_02D5F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D690AF mov eax, dword ptr fs:[00000030h] 13_2_02D690AF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D40050 mov eax, dword ptr fs:[00000030h] 13_2_02D40050
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D40050 mov eax, dword ptr fs:[00000030h] 13_2_02D40050
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBC450 mov eax, dword ptr fs:[00000030h] 13_2_02DBC450
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DBC450 mov eax, dword ptr fs:[00000030h] 13_2_02DBC450
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF1074 mov eax, dword ptr fs:[00000030h] 13_2_02DF1074
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE2073 mov eax, dword ptr fs:[00000030h] 13_2_02DE2073
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4746D mov eax, dword ptr fs:[00000030h] 13_2_02D4746D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF4015 mov eax, dword ptr fs:[00000030h] 13_2_02DF4015
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF4015 mov eax, dword ptr fs:[00000030h] 13_2_02DF4015
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA7016 mov eax, dword ptr fs:[00000030h] 13_2_02DA7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA7016 mov eax, dword ptr fs:[00000030h] 13_2_02DA7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA7016 mov eax, dword ptr fs:[00000030h] 13_2_02DA7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA6C0A mov eax, dword ptr fs:[00000030h] 13_2_02DA6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA6C0A mov eax, dword ptr fs:[00000030h] 13_2_02DA6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA6C0A mov eax, dword ptr fs:[00000030h] 13_2_02DA6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA6C0A mov eax, dword ptr fs:[00000030h] 13_2_02DA6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF740D mov eax, dword ptr fs:[00000030h] 13_2_02DF740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF740D mov eax, dword ptr fs:[00000030h] 13_2_02DF740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF740D mov eax, dword ptr fs:[00000030h] 13_2_02DF740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h] 13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3B02A mov eax, dword ptr fs:[00000030h] 13_2_02D3B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3B02A mov eax, dword ptr fs:[00000030h] 13_2_02D3B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3B02A mov eax, dword ptr fs:[00000030h] 13_2_02D3B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3B02A mov eax, dword ptr fs:[00000030h] 13_2_02D3B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5BC2C mov eax, dword ptr fs:[00000030h] 13_2_02D5BC2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DD8DF1 mov eax, dword ptr fs:[00000030h] 13_2_02DD8DF1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2B1E1 mov eax, dword ptr fs:[00000030h] 13_2_02D2B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2B1E1 mov eax, dword ptr fs:[00000030h] 13_2_02D2B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2B1E1 mov eax, dword ptr fs:[00000030h] 13_2_02D2B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DB41E8 mov eax, dword ptr fs:[00000030h] 13_2_02DB41E8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3D5E0 mov eax, dword ptr fs:[00000030h] 13_2_02D3D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D3D5E0 mov eax, dword ptr fs:[00000030h] 13_2_02D3D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5FD9B mov eax, dword ptr fs:[00000030h] 13_2_02D5FD9B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5FD9B mov eax, dword ptr fs:[00000030h] 13_2_02D5FD9B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5A185 mov eax, dword ptr fs:[00000030h] 13_2_02D5A185
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4C182 mov eax, dword ptr fs:[00000030h] 13_2_02D4C182
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D22D8A mov eax, dword ptr fs:[00000030h] 13_2_02D22D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D22D8A mov eax, dword ptr fs:[00000030h] 13_2_02D22D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D22D8A mov eax, dword ptr fs:[00000030h] 13_2_02D22D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D22D8A mov eax, dword ptr fs:[00000030h] 13_2_02D22D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D22D8A mov eax, dword ptr fs:[00000030h] 13_2_02D22D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D535A1 mov eax, dword ptr fs:[00000030h] 13_2_02D535A1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D47D50 mov eax, dword ptr fs:[00000030h] 13_2_02D47D50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4B944 mov eax, dword ptr fs:[00000030h] 13_2_02D4B944
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4B944 mov eax, dword ptr fs:[00000030h] 13_2_02D4B944
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D63D43 mov eax, dword ptr fs:[00000030h] 13_2_02D63D43
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DA3540 mov eax, dword ptr fs:[00000030h] 13_2_02DA3540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2B171 mov eax, dword ptr fs:[00000030h] 13_2_02D2B171
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2B171 mov eax, dword ptr fs:[00000030h] 13_2_02D2B171
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4C577 mov eax, dword ptr fs:[00000030h] 13_2_02D4C577
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D4C577 mov eax, dword ptr fs:[00000030h] 13_2_02D4C577
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2C962 mov eax, dword ptr fs:[00000030h] 13_2_02D2C962
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D29100 mov eax, dword ptr fs:[00000030h] 13_2_02D29100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D29100 mov eax, dword ptr fs:[00000030h] 13_2_02D29100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D29100 mov eax, dword ptr fs:[00000030h] 13_2_02D29100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D2AD30 mov eax, dword ptr fs:[00000030h] 13_2_02D2AD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h] 13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DF8D34 mov eax, dword ptr fs:[00000030h] 13_2_02DF8D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02DAA537 mov eax, dword ptr fs:[00000030h] 13_2_02DAA537
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D54D3B mov eax, dword ptr fs:[00000030h] 13_2_02D54D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D54D3B mov eax, dword ptr fs:[00000030h] 13_2_02D54D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D54D3B mov eax, dword ptr fs:[00000030h] 13_2_02D54D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5513A mov eax, dword ptr fs:[00000030h] 13_2_02D5513A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D5513A mov eax, dword ptr fs:[00000030h] 13_2_02D5513A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D44120 mov eax, dword ptr fs:[00000030h] 13_2_02D44120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D44120 mov eax, dword ptr fs:[00000030h] 13_2_02D44120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D44120 mov eax, dword ptr fs:[00000030h] 13_2_02D44120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D44120 mov eax, dword ptr fs:[00000030h] 13_2_02D44120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 13_2_02D44120 mov ecx, dword ptr fs:[00000030h] 13_2_02D44120
Enables debug privileges
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.thedreamcertificate.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 195.133.60.76 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.seahorseblast.net
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Memory written: C:\Users\user\Desktop\6KdTCZit4e.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Thread register set: target process: 3424 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Section unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: 200000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Process created: C:\Users\user\Desktop\6KdTCZit4e.exe C:\Users\user\Desktop\6KdTCZit4e.exe Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\6KdTCZit4e.exe' Jump to behavior
Source: explorer.exe, 00000008.00000000.764098320.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000008.00000000.765144690.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.926995438.0000000004230000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000008.00000000.765144690.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.926995438.0000000004230000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.765144690.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.926995438.0000000004230000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.765144690.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.926995438.0000000004230000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000008.00000000.748412391.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Users\user\Desktop\6KdTCZit4e.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs