Windows Analysis Report SecuriteInfo.com.Scr.Malcodegdn30.14926.25699

Overview

General Information

Sample Name: SecuriteInfo.com.Scr.Malcodegdn30.14926.25699 (renamed file extension from 25699 to exe)
Analysis ID: 483813
MD5: cca4950623ac43e8be352cd121ba8261
SHA1: e4f64701acab28b77b84257ccb418811c397650f
SHA256: 17b08e4418f813543e91ad18ae2e50ecfe40692d9b5dec854e94ec0abbc92b11
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains very large strings
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.midwestamericanwoman.com/ajki/"], "decoy": ["elborivegano.com", "jacksbookbuddies.com", "gentciu.com", "lovetattoonorteguadalix.com", "dahlkar.com", "hjobjiihna.club", "narccar.com", "noexcuseadventure.com", "mortongroverealestateinfo.com", "pursuegoodtimes.com", "becomearepresentativetoday.com", "20bagger.com", "lowestprices.space", "qzgay.com", "thegoenkapost.com", "glassdooronline.com", "quantizesoftware.com", "bayleighmphotography.com", "hzmm97.com", "theexoticbox.com", "verishop.site", "meusyouunlimited.com", "hvtnywveba.club", "yffuture.com", "bandsignsandgraphics.com", "rhealending.com", "studentlegalforms.com", "fubonbank.xyz", "themuslim101.com", "gigwindow.com", "thevillaflora.com", "fontankarecords.com", "liaofeng2008.com", "emerging.global", "rutasecretas.com", "imtheonlyperson.global", "bestforcrypto.com", "adasnspa.com", "abilityhomehealthservices.com", "travelfever-reiseblog.com", "redtail.football", "teatrodomorcego.com", "myfunkyshirt.com", "volanch.com", "ophelia.company", "learniapp.com", "inspiredsoulgifts.com", "citestasdsadasdwebzai.com", "wwwrijra.com", "esensites.com", "projetmaison64.com", "dailytipsones.com", "opticseurasia.com", "muslimsinsport.com", "kissbeauties.com", "aminarzhang.com", "empirepanada.com", "nilalvesfotografia.com", "eswensai.com", "espaciomeig.com", "pos010000.com", "qireys.com", "shethrivesvirtual.com", "nailch.com"]}
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Virustotal: Detection: 22% Perma Link
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe ReversingLabs: Detection: 22%
Yara detected FormBook
Source: Yara match File source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.midwestamericanwoman.com/ajki/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: www.midwestamericanwoman.com/ajki/ Virustotal: Detection: 5% Perma Link
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000002.375218047.000000000155F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000002.375218047.000000000155F000.00000040.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 4x nop then pop ebx 1_2_00407AE3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 4x nop then pop edi 1_2_0040E441
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 4x nop then pop edi 1_2_00417D6E

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.midwestamericanwoman.com/ajki/
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
.NET source code contains very large strings
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, Form1.cs Long String: Length: 38272
Source: 0.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.cs Long String: Length: 38272
Source: 0.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.cs Long String: Length: 38272
Source: 1.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.0.unpack, Form1.cs Long String: Length: 38272
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.1.unpack, Form1.cs Long String: Length: 38272
Uses 32bit PE files
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 0_2_00868CF4 0_2_00868CF4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 0_2_02B7E618 0_2_02B7E618
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 0_2_02B7E608 0_2_02B7E608
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041E875 1_2_0041E875
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041E027 1_2_0041E027
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00401030 1_2_00401030
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041D91D 1_2_0041D91D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041DA05 1_2_0041DA05
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041D5C8 1_2_0041D5C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00402D90 1_2_00402D90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00409E40 1_2_00409E40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00409E3B 1_2_00409E3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041D760 1_2_0041D760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041CFA3 1_2_0041CFA3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00402FB0 1_2_00402FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00978CF4 1_2_00978CF4
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00419D60 NtCreateFile, 1_2_00419D60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00419E10 NtReadFile, 1_2_00419E10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00419E90 NtClose, 1_2_00419E90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00419F40 NtAllocateVirtualMemory, 1_2_00419F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00419E8B NtClose, 1_2_00419E8B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00419F3A NtAllocateVirtualMemory, 1_2_00419F3A
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Binary or memory string: OriginalFilename vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.378089358.0000000007420000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000000.352664339.0000000000862000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameLoadConte.exeh$ vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.377933544.0000000007160000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameEnvoySinks.dll6 vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Binary or memory string: OriginalFilename vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000002.375819716.00000000016EF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000000.372794912.0000000000972000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameLoadConte.exeh$ vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Binary or memory string: OriginalFilenameLoadConte.exeh$ vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
PE file contains strange resources
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Virustotal: Detection: 22%
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe ReversingLabs: Detection: 22%
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.0.unpack, Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.1.unpack, Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000002.375218047.000000000155F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000002.375218047.000000000155F000.00000040.00000001.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.0.unpack, Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.1.unpack, Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 0_2_0086297F push 20000001h; retf 0_2_00862992
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00417869 push 2AF2D80Eh; ret 1_2_0041786E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_004170E3 push ecx; iretw 1_2_004170E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00417146 push edi; ret 1_2_00417151
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041711F pushfd ; retf 1_2_00417120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041720B push 0000004Bh; retf 1_2_0041721D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00407A8D push FFFFFF88h; ret 1_2_00407A8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041E410 push D4941EB5h; ret 1_2_0041E42E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041D5C8 push ecx; ret 1_2_0041D75D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041CEB5 push eax; ret 1_2_0041CF08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041CF6C push eax; ret 1_2_0041CF72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041CF02 push eax; ret 1_2_0041CF08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0041CF0B push eax; ret 1_2_0041CF72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00417721 push edi; ret 1_2_00417728
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_0097297F push 20000001h; retf 1_2_00972992
Source: initial sample Static PE information: section name: .text entropy: 7.55363015372
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe PID: 776, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe TID: 976 Thread sleep time: -34999s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe TID: 1748 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00409A90 rdtsc 1_2_00409A90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Thread delayed: delay time: 34999 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp Binary or memory string: vmware
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Code function: 1_2_00409A90 rdtsc 1_2_00409A90
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY