Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report SecuriteInfo.com.Scr.Malcodegdn30.14926.25699

Overview

General Information

Sample Name:SecuriteInfo.com.Scr.Malcodegdn30.14926.25699 (renamed file extension from 25699 to exe)
Analysis ID:483813
MD5:cca4950623ac43e8be352cd121ba8261
SHA1:e4f64701acab28b77b84257ccb418811c397650f
SHA256:17b08e4418f813543e91ad18ae2e50ecfe40692d9b5dec854e94ec0abbc92b11
Tags:exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains very large strings
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.midwestamericanwoman.com/ajki/"], "decoy": ["elborivegano.com", "jacksbookbuddies.com", "gentciu.com", "lovetattoonorteguadalix.com", "dahlkar.com", "hjobjiihna.club", "narccar.com", "noexcuseadventure.com", "mortongroverealestateinfo.com", "pursuegoodtimes.com", "becomearepresentativetoday.com", "20bagger.com", "lowestprices.space", "qzgay.com", "thegoenkapost.com", "glassdooronline.com", "quantizesoftware.com", "bayleighmphotography.com", "hzmm97.com", "theexoticbox.com", "verishop.site", "meusyouunlimited.com", "hvtnywveba.club", "yffuture.com", "bandsignsandgraphics.com", "rhealending.com", "studentlegalforms.com", "fubonbank.xyz", "themuslim101.com", "gigwindow.com", "thevillaflora.com", "fontankarecords.com", "liaofeng2008.com", "emerging.global", "rutasecretas.com", "imtheonlyperson.global", "bestforcrypto.com", "adasnspa.com", "abilityhomehealthservices.com", "travelfever-reiseblog.com", "redtail.football", "teatrodomorcego.com", "myfunkyshirt.com", "volanch.com", "ophelia.company", "learniapp.com", "inspiredsoulgifts.com", "citestasdsadasdwebzai.com", "wwwrijra.com", "esensites.com", "projetmaison64.com", "dailytipsones.com", "opticseurasia.com", "muslimsinsport.com", "kissbeauties.com", "aminarzhang.com", "empirepanada.com", "nilalvesfotografia.com", "eswensai.com", "espaciomeig.com", "pos010000.com", "qireys.com", "shethrivesvirtual.com", "nailch.com"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x18409:$sqlite3step: 68 34 1C 7B E1
    • 0x1851c:$sqlite3step: 68 34 1C 7B E1
    • 0x18438:$sqlite3text: 68 38 2A 90 C5
    • 0x1855d:$sqlite3text: 68 38 2A 90 C5
    • 0x1844b:$sqlite3blob: 68 53 D8 7F 8C
    • 0x18573:$sqlite3blob: 68 53 D8 7F 8C
    00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
      00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
        Click to see the 3 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x18409:$sqlite3step: 68 34 1C 7B E1
          • 0x1851c:$sqlite3step: 68 34 1C 7B E1
          • 0x18438:$sqlite3text: 68 38 2A 90 C5
          • 0x1855d:$sqlite3text: 68 38 2A 90 C5
          • 0x1844b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x18573:$sqlite3blob: 68 53 D8 7F 8C
          1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
            1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
            • 0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
            • 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
            • 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
            • 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
            • 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
            • 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
            • 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D
            • 0x1a527:$sequence_8: 3C 54 74 04 3C 74 75 F4
            • 0x1b52a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
            Click to see the 1 entries

            Sigma Overview

            No Sigma rule has matched

            Jbx Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Found malware configurationShow sources
            Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.midwestamericanwoman.com/ajki/"], "decoy": ["elborivegano.com", "jacksbookbuddies.com", "gentciu.com", "lovetattoonorteguadalix.com", "dahlkar.com", "hjobjiihna.club", "narccar.com", "noexcuseadventure.com", "mortongroverealestateinfo.com", "pursuegoodtimes.com", "becomearepresentativetoday.com", "20bagger.com", "lowestprices.space", "qzgay.com", "thegoenkapost.com", "glassdooronline.com", "quantizesoftware.com", "bayleighmphotography.com", "hzmm97.com", "theexoticbox.com", "verishop.site", "meusyouunlimited.com", "hvtnywveba.club", "yffuture.com", "bandsignsandgraphics.com", "rhealending.com", "studentlegalforms.com", "fubonbank.xyz", "themuslim101.com", "gigwindow.com", "thevillaflora.com", "fontankarecords.com", "liaofeng2008.com", "emerging.global", "rutasecretas.com", "imtheonlyperson.global", "bestforcrypto.com", "adasnspa.com", "abilityhomehealthservices.com", "travelfever-reiseblog.com", "redtail.football", "teatrodomorcego.com", "myfunkyshirt.com", "volanch.com", "ophelia.company", "learniapp.com", "inspiredsoulgifts.com", "citestasdsadasdwebzai.com", "wwwrijra.com", "esensites.com", "projetmaison64.com", "dailytipsones.com", "opticseurasia.com", "muslimsinsport.com", "kissbeauties.com", "aminarzhang.com", "empirepanada.com", "nilalvesfotografia.com", "eswensai.com", "espaciomeig.com", "pos010000.com", "qireys.com", "shethrivesvirtual.com", "nailch.com"]}
            Multi AV Scanner detection for submitted fileShow sources
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeVirustotal: Detection: 22%Perma Link
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeReversingLabs: Detection: 22%
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY
            Antivirus detection for URL or domainShow sources
            Source: www.midwestamericanwoman.com/ajki/Avira URL Cloud: Label: malware
            Multi AV Scanner detection for domain / URLShow sources
            Source: www.midwestamericanwoman.com/ajki/Virustotal: Detection: 5%Perma Link
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000002.375218047.000000000155F000.00000040.00000001.sdmp
            Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000002.375218047.000000000155F000.00000040.00000001.sdmp
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 4x nop then pop ebx
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 4x nop then pop edi
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 4x nop then pop edi

            Networking:

            barindex
            C2 URLs / IPs found in malware configurationShow sources
            Source: Malware configuration extractorURLs: www.midwestamericanwoman.com/ajki/
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn

            E-Banking Fraud:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY

            System Summary:

            barindex
            Malicious sample detected (through community Yara rule)Show sources
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            .NET source code contains very large stringsShow sources
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, Form1.csLong String: Length: 38272
            Source: 0.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.csLong String: Length: 38272
            Source: 0.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.csLong String: Length: 38272
            Source: 1.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.0.unpack, Form1.csLong String: Length: 38272
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.1.unpack, Form1.csLong String: Length: 38272
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 0_2_00868CF4
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 0_2_02B7E618
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 0_2_02B7E608
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041E875
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041E027
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00401030
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041D91D
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041DA05
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041D5C8
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00402D90
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00409E40
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00409E3B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041D760
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041CFA3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00402FB0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00978CF4
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00419D60 NtCreateFile,
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00419E10 NtReadFile,
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00419E90 NtClose,
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00419F40 NtAllocateVirtualMemory,
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00419E8B NtClose,
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00419F3A NtAllocateVirtualMemory,
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.378089358.0000000007420000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameCF_Secretaria.dll< vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000000.352664339.0000000000862000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameLoadConte.exeh$ vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.377933544.0000000007160000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameEnvoySinks.dll6 vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000002.375819716.00000000016EF000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000000.372794912.0000000000972000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameLoadConte.exeh$ vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeBinary or memory string: OriginalFilenameLoadConte.exeh$ vs SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeVirustotal: Detection: 22%
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeReversingLabs: Detection: 22%
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
            Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe'
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.logJump to behavior
            Source: classification engineClassification label: mal100.troj.evad.winEXE@3/1@0/0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
            Source: 0.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
            Source: 0.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
            Source: 1.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.0.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.1.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000002.375218047.000000000155F000.00000040.00000001.sdmp
            Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000001.00000002.375218047.000000000155F000.00000040.00000001.sdmp

            Data Obfuscation:

            barindex
            .NET source code contains potential unpackerShow sources
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
            Source: 0.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
            Source: 0.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.860000.0.unpack, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
            Source: 1.0.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.0.unpack, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
            Source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.970000.1.unpack, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 0_2_0086297F push 20000001h; retf
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00417869 push 2AF2D80Eh; ret
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_004170E3 push ecx; iretw
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00417146 push edi; ret
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041711F pushfd ; retf
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041720B push 0000004Bh; retf
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00407A8D push FFFFFF88h; ret
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041E410 push D4941EB5h; ret
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041D5C8 push ecx; ret
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041CEB5 push eax; ret
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041CF6C push eax; ret
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041CF02 push eax; ret
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0041CF0B push eax; ret
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00417721 push edi; ret
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_0097297F push 20000001h; retf
            Source: initial sampleStatic PE information: section name: .text entropy: 7.55363015372
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion:

            barindex
            Yara detected AntiVM3Show sources
            Source: Yara matchFile source: 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe PID: 776, type: MEMORYSTR
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
            Tries to detect virtualization through RDTSC time measurementsShow sources
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeRDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeRDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe TID: 976Thread sleep time: -34999s >= -30000s
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe TID: 1748Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00409A90 rdtsc
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess information queried: ProcessInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeThread delayed: delay time: 34999
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeThread delayed: delay time: 922337203685477
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: vmware
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: VMWARE
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
            Source: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeCode function: 1_2_00409A90 rdtsc
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess queried: DebugPort
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeMemory allocated: page read and write | page guard

            HIPS / PFW / Operating System Protection Evasion:

            barindex
            Injects a PE file into a foreign processesShow sources
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeMemory written: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe base: 400000 value starts with: 4D5A
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

            Stealing of Sensitive Information:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY

            Remote Access Functionality:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection111Masquerading1OS Credential DumpingSecurity Software Discovery221Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryProcess Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion31Security Account ManagerVirtualization/Sandbox Evasion31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection111NTDSSystem Information Discovery112Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information3Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing13DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.

            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            SecuriteInfo.com.Scr.Malcodegdn30.14926.exe22%VirustotalBrowse
            SecuriteInfo.com.Scr.Malcodegdn30.14926.exe22%ReversingLabsByteCode-MSIL.Trojan.SnakeKeylogger

            Dropped Files

            No Antivirus matches

            Unpacked PE Files

            SourceDetectionScannerLabelLinkDownload
            1.2.SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

            Domains

            No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
            http://www.tiro.com0%URL Reputationsafe
            http://www.goodfont.co.kr0%URL Reputationsafe
            http://www.carterandcone.coml0%URL Reputationsafe
            http://www.sajatypeworks.com0%URL Reputationsafe
            http://www.typography.netD0%URL Reputationsafe
            http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
            http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
            http://fontfabrik.com0%URL Reputationsafe
            http://www.founder.com.cn/cn0%URL Reputationsafe
            www.midwestamericanwoman.com/ajki/6%VirustotalBrowse
            www.midwestamericanwoman.com/ajki/100%Avira URL Cloudmalware
            http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
            http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
            http://www.sandoll.co.kr0%URL Reputationsafe
            http://www.urwpp.deDPlease0%URL Reputationsafe
            http://www.zhongyicts.com.cn0%URL Reputationsafe
            http://www.sakkal.com0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            No contacted domains info

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            www.midwestamericanwoman.com/ajki/true
            • 6%, Virustotal, Browse
            • Avira URL Cloud: malware
            		low

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://www.apache.org/licenses/LICENSE-2.0SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
              		high
              http://www.fontbureau.comSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                		high
                http://www.fontbureau.com/designersGSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                  		high
                  http://www.fontbureau.com/designers/?SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                    		high
                    http://www.founder.com.cn/cn/bTheSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.fontbureau.com/designers?SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                      		high
                      http://www.tiro.comSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.fontbureau.com/designersSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                        		high
                        http://www.goodfont.co.krSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.carterandcone.comlSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.sajatypeworks.comSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.typography.netDSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers/cabarga.htmlNSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                          		high
                          http://www.founder.com.cn/cn/cTheSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.galapagosdesign.com/staff/dennis.htmSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://fontfabrik.comSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.founder.com.cn/cnSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers/frere-jones.htmlSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                            		high
                            http://www.jiyu-kobo.co.jp/SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.galapagosdesign.com/DPleaseSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designers8SecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                              		high
                              http://www.fonts.comSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                                		high
                                http://www.sandoll.co.krSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.urwpp.deDPleaseSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.zhongyicts.com.cnSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.sakkal.comSecuriteInfo.com.Scr.Malcodegdn30.14926.exe, 00000000.00000002.376863059.0000000006C82000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown

                                Contacted IPs

                                No contacted IP infos

                                General Information

                                Joe Sandbox Version:33.0.0 White Diamond
                                Analysis ID:483813
                                Start date:15.09.2021
                                Start time:14:17:16
                                Joe Sandbox Product:CloudBasic
                                Overall analysis duration:0h 7m 7s
                                Hypervisor based Inspection enabled:false
                                Report type:light
                                Sample file name:SecuriteInfo.com.Scr.Malcodegdn30.14926.25699 (renamed file extension from 25699 to exe)
                                Cookbook file name:default.jbs
                                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                Number of analysed new started processes analysed:2
                                Number of new started drivers analysed:0
                                Number of existing processes analysed:0
                                Number of existing drivers analysed:0
                                Number of injected processes analysed:0
                                Technologies:
                                • HCA enabled
                                • EGA enabled
                                • HDC enabled
                                • AMSI enabled
                                Analysis Mode:default
                                Analysis stop reason:Timeout
                                Detection:MAL
                                Classification:mal100.troj.evad.winEXE@3/1@0/0
                                EGA Information:Failed
                                HDC Information:
                                • Successful, ratio: 21.2% (good quality ratio 20.6%)
                                • Quality average: 76.2%
                                • Quality standard deviation: 26.4%
                                HCA Information:
                                • Successful, ratio: 99%
                                • Number of executed functions: 0
                                • Number of non-executed functions: 0
                                Cookbook Comments:
                                • Adjust boot time
                                • Enable AMSI
                                • Stop behavior analysis, all processes terminated
                                Warnings:
                                Show All
                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.

                                Simulations

                                Behavior and APIs

                                TimeTypeDescription
                                14:18:27API Interceptor1x Sleep call for process: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe modified

                                Joe Sandbox View / Context

                                IPs

                                No context

                                Domains

                                No context

                                ASN

                                No context

                                JA3 Fingerprints

                                No context

                                Dropped Files

                                No context

                                Created / dropped Files

                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe.log
                                Process:C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
                                File Type:ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):1216
                                Entropy (8bit):5.355304211458859
                                Encrypted:false
                                SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                Malicious:true
                                Reputation:high, very likely benign file
                                Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                Static File Info

                                General

                                File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                Entropy (8bit):7.4841617330315415
                                TrID:
                                • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                • Win32 Executable (generic) a (10002005/4) 49.78%
                                • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                • Win16/32 Executable Delphi generic (2074/23) 0.01%
                                • Generic Win/DOS Executable (2004/3) 0.01%
                                File name:SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
                                File size:721408
                                MD5:cca4950623ac43e8be352cd121ba8261
                                SHA1:e4f64701acab28b77b84257ccb418811c397650f
                                SHA256:17b08e4418f813543e91ad18ae2e50ecfe40692d9b5dec854e94ec0abbc92b11
                                SHA512:d9ad10f18822b8f38f314433abc6c6bc26d429ec4fc2be4a62ec016a91387ea00eef7069b24f2255a6e44cd57d958e80480ce36a67f9a0db2ec027744e125e43
                                SSDEEP:12288:FZWHCM2K4CRI/yzQs2TaIpIInMpiuskOOxO7xakoq9laQCI:FL3CWMIpIAUbxADlZCI
                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Aa..............0......n........... ........@.. .......................`............@................................

                                File Icon

                                Icon Hash:f1f0f4d0eecccc71

                                Static PE Info

                                General

                                Entrypoint:0x4ab0a6
                                Entrypoint Section:.text
                                Digitally signed:false
                                Imagebase:0x400000
                                Subsystem:windows gui
                                Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                Time Stamp:0x6141BBDD [Wed Sep 15 09:24:45 2021 UTC]
                                TLS Callbacks:
                                CLR (.Net) Version:v4.0.30319
                                OS Version Major:4
                                OS Version Minor:0
                                File Version Major:4
                                File Version Minor:0
                                Subsystem Version Major:4
                                Subsystem Version Minor:0
                                Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                Entrypoint Preview

                                Instruction
                                jmp dword ptr [00402000h]
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al

                                Data Directories

                                NameVirtual AddressVirtual Size Is in Section
                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IMPORT0xab0540x4f.text
                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xac0000x6b80.rsrc
                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                IMAGE_DIRECTORY_ENTRY_BASERELOC0xb40000xc.reloc
                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                Sections

                                NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                .text0x20000xa90ac0xa9200False0.827605321508data7.55363015372IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                .rsrc0xac0000x6b800x6c00False0.442563657407data5.0922815023IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                .reloc0xb40000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                Resources

                                NameRVASizeTypeLanguageCountry
                                RT_ICON0xac2000x668data
                                RT_ICON0xac8780x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 1953594267, next used block 28725
                                RT_ICON0xacb700x128GLS_BINARY_LSB_FIRST
                                RT_ICON0xacca80xea8data
                                RT_ICON0xadb600x8a8dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0
                                RT_ICON0xae4180x568GLS_BINARY_LSB_FIRST
                                RT_ICON0xae9900x25a8data
                                RT_ICON0xb0f480x10a8data
                                RT_ICON0xb20000x468GLS_BINARY_LSB_FIRST
                                RT_GROUP_ICON0xb24780x84data
                                RT_VERSION0xb250c0x474data
                                RT_MANIFEST0xb29900x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                Imports

                                DLLImport
                                mscoree.dll_CorExeMain

                                Version Infos

                                DescriptionData
                                Translation0x0000 0x04b0
                                LegalCopyrightCopyright 2008 - 2010
                                Assembly Version1.3.0.0
                                InternalNameLoadConte.exe
                                FileVersion1.3.0.0
                                CompanyNameWHC
                                LegalTrademarks
                                CommentsA little Tool where you can check the stats of your RYL - Risk Your Life - characters. Ruins of War version.
                                ProductNameRYL Character Tool - RoW EU version
                                ProductVersion1.3.0.0
                                FileDescriptionRYL Character Tool - RoW EU version
                                OriginalFilenameLoadConte.exe

                                Network Behavior

                                No network behavior found

                                Code Manipulations

                                Statistics

                                Behavior

                                Click to jump to process

                                System Behavior

                                Analysis Process: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe PID: 776 Parent PID: 6076

                                General

                                Start time:14:18:19
                                Start date:15/09/2021
                                Path:C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
                                Wow64 process (32bit):true
                                Commandline:'C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe'
                                Imagebase:0x860000
                                File size:721408 bytes
                                MD5 hash:CCA4950623AC43E8BE352CD121BA8261
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:.Net C# or VB.NET
                                Yara matches:
                                • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.374444260.0000000002BA2000.00000004.00000001.sdmp, Author: Joe Security
                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, Author: Joe Security
                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.374827398.0000000003B99000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                Reputation:low

                                Analysis Process: SecuriteInfo.com.Scr.Malcodegdn30.14926.exe PID: 3148 Parent PID: 776

                                General

                                Start time:14:18:28
                                Start date:15/09/2021
                                Path:C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
                                Wow64 process (32bit):true
                                Commandline:C:\Users\user\Desktop\SecuriteInfo.com.Scr.Malcodegdn30.14926.exe
                                Imagebase:0x970000
                                File size:721408 bytes
                                MD5 hash:CCA4950623AC43E8BE352CD121BA8261
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Yara matches:
                                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                • Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.374677540.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                Reputation:low

                                Disassembly

                                Code Analysis

                                Reset < >