Loading ...

Play interactive tourEdit tour

Windows Analysis Report quotation...exe

Overview

General Information

Sample Name:quotation...exe
Analysis ID:483875
MD5:a0136f82865d2e88efa2bc913a75716c
SHA1:28162b2798265b1406f3c08bff44f9b0ea50d6c4
SHA256:6c5927406212482df7ad0b2b13010541e7377ae5d392a9cc531d942872dcb22f
Tags:agentteslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Multi AV Scanner detection for dropped file
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains very large strings
Tries to steal Mail credentials (via file access)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • quotation...exe (PID: 6048 cmdline: 'C:\Users\user\Desktop\quotation...exe' MD5: A0136F82865D2E88EFA2BC913A75716C)
    • schtasks.exe (PID: 4632 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pynXGlCh' /XML 'C:\Users\user\AppData\Local\Temp\tmp1BD9.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • quotation...exe (PID: 5876 cmdline: C:\Users\user\Desktop\quotation...exe MD5: A0136F82865D2E88EFA2BC913A75716C)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "efiz@glimpse-it.co", "Password": "@Mexico1.,", "Host": "mail.privateemail.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.511804443.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000008.00000002.511804443.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000001.00000002.271683451.0000000003A9B000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000001.00000002.271683451.0000000003A9B000.00000004.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
            Click to see the 8 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.quotation...exe.3909ed0.2.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.quotation...exe.3909ed0.2.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                1.2.quotation...exe.3909ed0.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  1.2.quotation...exe.3909ed0.2.raw.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    8.2.quotation...exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 1 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 1.2.quotation...exe.3909ed0.2.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "efiz@glimpse-it.co", "Password": "@Mexico1.,", "Host": "mail.privateemail.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: quotation...exeVirustotal: Detection: 22%Perma Link
                      Source: quotation...exeReversingLabs: Detection: 15%
                      Multi AV Scanner detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\pynXGlCh.exeVirustotal: Detection: 22%Perma Link
                      Source: C:\Users\user\AppData\Roaming\pynXGlCh.exeReversingLabs: Detection: 15%
                      Source: 8.2.quotation...exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: quotation...exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: quotation...exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Joe Sandbox ViewIP Address: 198.54.122.60 198.54.122.60
                      Source: global trafficTCP traffic: 192.168.2.5:49791 -> 198.54.122.60:587
                      Source: global trafficTCP traffic: 192.168.2.5:49791 -> 198.54.122.60:587
                      Source: quotation...exe, 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: quotation...exe, 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: quotation...exe, 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmpString found in binary or memory: http://UDgegU.com
                      Source: quotation...exe, 00000008.00000002.518373119.0000000003473000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
                      Source: quotation...exe, 00000008.00000002.519899547.00000000065DF000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
                      Source: quotation...exe, 00000008.00000002.518373119.0000000003473000.00000004.00000001.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: quotation...exe, 00000008.00000002.518419071.0000000003492000.00000004.00000001.sdmp, quotation...exe, 00000008.00000002.518435325.000000000349B000.00000004.00000001.sdmp, quotation...exe, 00000008.00000002.518274532.000000000342C000.00000004.00000001.sdmp, quotation...exe, 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmpString found in binary or memory: http://kk9JcHjDdoLBIcKJ.com
                      Source: quotation...exe, 00000008.00000002.518355620.000000000346D000.00000004.00000001.sdmpString found in binary or memory: http://mail.privateemail.com
                      Source: quotation...exe, 00000008.00000002.518373119.0000000003473000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                      Source: quotation...exe, 00000008.00000002.518373119.0000000003473000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.sectigo.com0
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: quotation...exe, 00000008.00000002.518373119.0000000003473000.00000004.00000001.sdmpString found in binary or memory: https://sectigo.com/CPS0
                      Source: quotation...exe, 00000001.00000002.271683451.0000000003A9B000.00000004.00000001.sdmp, quotation...exe, 00000008.00000002.511804443.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: quotation...exe, 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: unknownDNS traffic detected: queries for: mail.privateemail.com
                      Source: quotation...exe, 00000001.00000002.269674937.0000000000AB0000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                      System Summary:

                      barindex
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: quotation...exe
                      .NET source code contains very large stringsShow sources
                      Source: quotation...exe, Form1.csLong String: Length: 38272
                      Source: pynXGlCh.exe.1.dr, Form1.csLong String: Length: 38272
                      Source: 1.0.quotation...exe.300000.0.unpack, Form1.csLong String: Length: 38272
                      Source: 1.2.quotation...exe.300000.0.unpack, Form1.csLong String: Length: 38272
                      Source: 8.0.quotation...exe.e30000.0.unpack, Form1.csLong String: Length: 38272
                      Source: 8.2.quotation...exe.e30000.1.unpack, Form1.csLong String: Length: 38272
                      Source: quotation...exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_00D4E6181_2_00D4E618
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_00D4E6081_2_00D4E608
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_00D4BC741_2_00D4BC74
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_026D13D81_2_026D13D8
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_026D37801_2_026D3780
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_026D20E81_2_026D20E8
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_026D01441_2_026D0144
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_026D0D381_2_026D0D38
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 8_2_0161BA188_2_0161BA18
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 8_2_016157008_2_01615700
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 8_2_016169A08_2_016169A0
                      Source: quotation...exeBinary or memory string: OriginalFilename vs quotation...exe
                      Source: quotation...exe, 00000001.00000002.275350726.0000000008750000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameCF_Secretaria.dll< vs quotation...exe
                      Source: quotation...exe, 00000001.00000002.268956621.0000000000302000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameNullStre.exeh$ vs quotation...exe
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameEnvoySinks.dll6 vs quotation...exe
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamevFpoTsgsPDdoNzVEJsRJKKKqTyhCOe.exe4 vs quotation...exe
                      Source: quotation...exe, 00000001.00000002.269674937.0000000000AB0000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs quotation...exe
                      Source: quotation...exeBinary or memory string: OriginalFilename vs quotation...exe
                      Source: quotation...exe, 00000008.00000000.268006921.0000000000E32000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameNullStre.exeh$ vs quotation...exe
                      Source: quotation...exe, 00000008.00000002.513776250.00000000012F8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs quotation...exe
                      Source: quotation...exe, 00000008.00000002.511804443.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamevFpoTsgsPDdoNzVEJsRJKKKqTyhCOe.exe4 vs quotation...exe
                      Source: quotation...exeBinary or memory string: OriginalFilenameNullStre.exeh$ vs quotation...exe
                      Source: quotation...exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: quotation...exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: quotation...exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: pynXGlCh.exe.1.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: pynXGlCh.exe.1.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: pynXGlCh.exe.1.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: quotation...exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: pynXGlCh.exe.1.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: quotation...exeVirustotal: Detection: 22%
                      Source: quotation...exeReversingLabs: Detection: 15%
                      Source: C:\Users\user\Desktop\quotation...exeFile read: C:\Users\user\Desktop\quotation...exeJump to behavior
                      Source: quotation...exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\quotation...exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\quotation...exe 'C:\Users\user\Desktop\quotation...exe'
                      Source: C:\Users\user\Desktop\quotation...exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pynXGlCh' /XML 'C:\Users\user\AppData\Local\Temp\tmp1BD9.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\quotation...exeProcess created: C:\Users\user\Desktop\quotation...exe C:\Users\user\Desktop\quotation...exe
                      Source: C:\Users\user\Desktop\quotation...exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pynXGlCh' /XML 'C:\Users\user\AppData\Local\Temp\tmp1BD9.tmp'Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess created: C:\Users\user\Desktop\quotation...exe C:\Users\user\Desktop\quotation...exeJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\quotation...exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\quotation...exeFile created: C:\Users\user\AppData\Roaming\pynXGlCh.exeJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeFile created: C:\Users\user\AppData\Local\Temp\tmp1BD9.tmpJump to behavior
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/4@1/2
                      Source: C:\Users\user\Desktop\quotation...exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_01
                      Source: C:\Users\user\Desktop\quotation...exeMutant created: \Sessions\1\BaseNamedObjects\KTSLPHLVTS
                      Source: quotation...exe, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: pynXGlCh.exe.1.dr, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 1.0.quotation...exe.300000.0.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 1.2.quotation...exe.300000.0.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 8.0.quotation...exe.e30000.0.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 8.2.quotation...exe.e30000.1.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: C:\Users\user\Desktop\quotation...exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: quotation...exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: quotation...exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: quotation...exe, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: pynXGlCh.exe.1.dr, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 1.0.quotation...exe.300000.0.unpack, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 1.2.quotation...exe.300000.0.unpack, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 8.0.quotation...exe.e30000.0.unpack, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 8.2.quotation...exe.e30000.1.unpack, Form1.cs.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_0030297F push 20000001h; retf 1_2_00302992
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_0877A96C pushfd ; ret 1_2_0877A96E
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_0877E1D7 pushfd ; retf 1_2_0877E1D8
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 1_2_00D4D9B8 push cs; retn 0004h1_2_00D4D9C2
                      Source: C:\Users\user\Desktop\quotation...exeCode function: 8_2_00E3297F push 20000001h; retf 8_2_00E32992
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.5296902445
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.5296902445
                      Source: C:\Users\user\Desktop\quotation...exeFile created: C:\Users\user\AppData\Roaming\pynXGlCh.exeJump to dropped file

                      Boot Survival:

                      barindex
                      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                      Source: C:\Users\user\Desktop\quotation...exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pynXGlCh' /XML 'C:\Users\user\AppData\Local\Temp\tmp1BD9.tmp'
                      Source: C:\Users\user\Desktop\quotation...exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: quotation...exe PID: 6048, type: MEMORYSTR
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\quotation...exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\quotation...exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\quotation...exe TID: 5808Thread sleep time: -44276s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exe TID: 5808Thread sleep time: -40000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exe TID: 3712Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exe TID: 6180Thread sleep time: -11990383647911201s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exe TID: 6188Thread sleep count: 901 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exe TID: 6188Thread sleep count: 8914 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exe TID: 6180Thread sleep count: 32 > 30Jump to behavior
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\quotation...exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeWindow / User API: threadDelayed 901Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeWindow / User API: threadDelayed 8914Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\quotation...exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\quotation...exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeThread delayed: delay time: 44276Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeThread delayed: delay time: 40000Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: quotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: C:\Users\user\Desktop\quotation...exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\quotation...exeMemory written: C:\Users\user\Desktop\quotation...exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pynXGlCh' /XML 'C:\Users\user\AppData\Local\Temp\tmp1BD9.tmp'Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeProcess created: C:\Users\user\Desktop\quotation...exe C:\Users\user\Desktop\quotation...exeJump to behavior
                      Source: quotation...exe, 00000008.00000002.517227149.0000000001BC0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: quotation...exe, 00000008.00000002.517227149.0000000001BC0000.00000002.00020000.sdmpBinary or memory string: Progman
                      Source: quotation...exe, 00000008.00000002.517227149.0000000001BC0000.00000002.00020000.sdmpBinary or memory string: SProgram Managerl
                      Source: quotation...exe, 00000008.00000002.517227149.0000000001BC0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd,
                      Source: quotation...exe, 00000008.00000002.517227149.0000000001BC0000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Users\user\Desktop\quotation...exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Users\user\Desktop\quotation...exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 1.2.quotation...exe.3909ed0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.quotation...exe.3909ed0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 8.2.quotation...exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000008.00000002.511804443.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.271683451.0000000003A9B000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.271066231.0000000003849000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: quotation...exe PID: 6048, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: quotation...exe PID: 5876, type: MEMORYSTR
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\quotation...exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                      Tries to harvest and steal ftp login credentialsShow sources
                      Source: C:\Users\user\Desktop\quotation...exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
                      Tries to steal Mail credentials (via file access)Show sources
                      Source: C:\Users\user\Desktop\quotation...exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\quotation...exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                      Source: C:\Users\user\Desktop\quotation...exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                      Source: Yara matchFile source: 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: quotation...exe PID: 5876, type: MEMORYSTR

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 1.2.quotation...exe.3909ed0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.quotation...exe.3909ed0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 8.2.quotation...exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000008.00000002.511804443.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.271683451.0000000003A9B000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.271066231.0000000003849000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: quotation...exe PID: 6048, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: quotation...exe PID: 5876, type: MEMORYSTR

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Scheduled Task/Job1Process Injection112Disable or Modify Tools1OS Credential Dumping2File and Directory Discovery1Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/Job1Boot or Logon Initialization ScriptsScheduled Task/Job1Deobfuscate/Decode Files or Information1Input Capture1System Information Discovery114Remote Desktop ProtocolData from Local System2Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information2Credentials in Registry1Query Registry1SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Software Packing13NTDSSecurity Software Discovery311Distributed Component Object ModelInput Capture1Scheduled TransferApplication Layer Protocol11SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptMasquerading1LSA SecretsProcess Discovery2SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonVirtualization/Sandbox Evasion131Cached Domain CredentialsVirtualization/Sandbox Evasion131VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsProcess Injection112DCSyncApplication Window Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemRemote System Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 signatures2 2 Behavior Graph ID: 483875 Sample: quotation...exe Startdate: 15/09/2021 Architecture: WINDOWS Score: 100 29 Found malware configuration 2->29 31 Multi AV Scanner detection for dropped file 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 6 other signatures 2->35 7 quotation...exe 7 2->7         started        process3 file4 19 C:\Users\user\AppData\Roaming\pynXGlCh.exe, PE32 7->19 dropped 21 C:\Users\user\AppData\Local\...\tmp1BD9.tmp, XML 7->21 dropped 23 C:\Users\user\AppData\...\quotation...exe.log, ASCII 7->23 dropped 37 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->37 39 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->39 41 Uses schtasks.exe or at.exe to add and modify task schedules 7->41 43 Injects a PE file into a foreign processes 7->43 11 quotation...exe 2 7->11         started        15 schtasks.exe 1 7->15         started        signatures5 process6 dnsIp7 25 mail.privateemail.com 198.54.122.60, 49791, 587 NAMECHEAP-NETUS United States 11->25 27 192.168.2.1 unknown unknown 11->27 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->45 47 Tries to steal Mail credentials (via file access) 11->47 49 Tries to harvest and steal ftp login credentials 11->49 51 Tries to harvest and steal browser information (history, passwords, etc) 11->51 17 conhost.exe 15->17         started        signatures8 process9

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      quotation...exe22%VirustotalBrowse
                      quotation...exe16%ReversingLabsByteCode-MSIL.Trojan.SnakeKeylogger

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Roaming\pynXGlCh.exe22%VirustotalBrowse
                      C:\Users\user\AppData\Roaming\pynXGlCh.exe16%ReversingLabsByteCode-MSIL.Trojan.SnakeKeylogger

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      8.2.quotation...exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://kk9JcHjDdoLBIcKJ.com0%Avira URL Cloudsafe
                      http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#0%URL Reputationsafe
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      https://sectigo.com/CPS00%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://ocsp.sectigo.com00%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://UDgegU.com0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      mail.privateemail.com
                      198.54.122.60
                      truefalse
                        high

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://kk9JcHjDdoLBIcKJ.comquotation...exe, 00000008.00000002.518419071.0000000003492000.00000004.00000001.sdmp, quotation...exe, 00000008.00000002.518435325.000000000349B000.00000004.00000001.sdmp, quotation...exe, 00000008.00000002.518274532.000000000342C000.00000004.00000001.sdmp, quotation...exe, 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#quotation...exe, 00000008.00000002.518373119.0000000003473000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        unknown
                        http://127.0.0.1:HTTP/1.1quotation...exe, 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        low
                        http://www.apache.org/licenses/LICENSE-2.0quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                          high
                          http://www.fontbureau.comquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                            high
                            http://www.fontbureau.com/designersGquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                              high
                              http://DynDns.comDynDNSquotation...exe, 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              unknown
                              https://sectigo.com/CPS0quotation...exe, 00000008.00000002.518373119.0000000003473000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              unknown
                              http://www.fontbureau.com/designers/?quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                high
                                http://www.founder.com.cn/cn/bThequotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                unknown
                                http://ocsp.sectigo.com0quotation...exe, 00000008.00000002.518373119.0000000003473000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                unknown
                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haquotation...exe, 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                unknown
                                http://www.fontbureau.com/designers?quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                  high
                                  http://www.tiro.comquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  unknown
                                  http://www.fontbureau.com/designersquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                    high
                                    http://www.goodfont.co.krquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    unknown
                                    http://mail.privateemail.comquotation...exe, 00000008.00000002.518355620.000000000346D000.00000004.00000001.sdmpfalse
                                      high
                                      http://www.carterandcone.comlquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      unknown
                                      http://www.sajatypeworks.comquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      unknown
                                      http://www.typography.netDquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      unknown
                                      http://www.fontbureau.com/designers/cabarga.htmlNquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                        high
                                        http://www.founder.com.cn/cn/cThequotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        unknown
                                        http://www.galapagosdesign.com/staff/dennis.htmquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        unknown
                                        http://fontfabrik.comquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        unknown
                                        http://www.founder.com.cn/cnquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        unknown
                                        http://www.fontbureau.com/designers/frere-jones.htmlquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                          high
                                          http://www.jiyu-kobo.co.jp/quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          unknown
                                          http://www.galapagosdesign.com/DPleasequotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          unknown
                                          http://www.fontbureau.com/designers8quotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                            high
                                            http://www.fonts.comquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                              high
                                              http://www.sandoll.co.krquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              unknown
                                              http://www.urwpp.deDPleasequotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              unknown
                                              http://www.zhongyicts.com.cnquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              unknown
                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namequotation...exe, 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmpfalse
                                                high
                                                http://www.sakkal.comquotation...exe, 00000001.00000002.274748849.00000000067A2000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                unknown
                                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipquotation...exe, 00000001.00000002.271683451.0000000003A9B000.00000004.00000001.sdmp, quotation...exe, 00000008.00000002.511804443.0000000000402000.00000040.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                unknown
                                                http://UDgegU.comquotation...exe, 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown

                                                Contacted IPs

                                                • No. of IPs < 25%
                                                • 25% < No. of IPs < 50%
                                                • 50% < No. of IPs < 75%
                                                • 75% < No. of IPs

                                                Public

                                                IPDomainCountryFlagASNASN NameMalicious
                                                198.54.122.60
                                                mail.privateemail.comUnited States
                                                22612NAMECHEAP-NETUSfalse

                                                Private

                                                IP
                                                192.168.2.1

                                                General Information

                                                Joe Sandbox Version:33.0.0 White Diamond
                                                Analysis ID:483875
                                                Start date:15.09.2021
                                                Start time:15:32:58
                                                Joe Sandbox Product:CloudBasic
                                                Overall analysis duration:0h 9m 54s
                                                Hypervisor based Inspection enabled:false
                                                Report type:full
                                                Sample file name:quotation...exe
                                                Cookbook file name:default.jbs
                                                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                Number of analysed new started processes analysed:28
                                                Number of new started drivers analysed:0
                                                Number of existing processes analysed:0
                                                Number of existing drivers analysed:0
                                                Number of injected processes analysed:0
                                                Technologies:
                                                • HCA enabled
                                                • EGA enabled
                                                • HDC enabled
                                                • AMSI enabled
                                                Analysis Mode:default
                                                Analysis stop reason:Timeout
                                                Detection:MAL
                                                Classification:mal100.troj.spyw.evad.winEXE@6/4@1/2
                                                EGA Information:Failed
                                                HDC Information:
                                                • Successful, ratio: 1.3% (good quality ratio 0.9%)
                                                • Quality average: 49.2%
                                                • Quality standard deviation: 35.4%
                                                HCA Information:
                                                • Successful, ratio: 86%
                                                • Number of executed functions: 29
                                                • Number of non-executed functions: 3
                                                Cookbook Comments:
                                                • Adjust boot time
                                                • Enable AMSI
                                                • Found application associated with file extension: .exe
                                                Warnings:
                                                Show All
                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                • Excluded IPs from analysis (whitelisted): 92.122.145.220, 23.35.236.56, 13.107.5.88, 13.107.42.23, 20.199.120.182, 20.82.210.154, 20.199.120.151, 40.112.88.60, 20.50.102.62, 23.216.77.208, 23.216.77.209, 20.199.120.85
                                                • Excluded domains from analysis (whitelisted): client-office365-tas.msedge.net, ocos-office365-s2s.msedge.net, config.edge.skype.com.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, e-0009.e-msedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, config-edge-skype.l-0014.l-msedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, l-0014.config.skype.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, client.wns.windows.com, fs.microsoft.com, afdo-tas-offload.trafficmanager.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, vip2-wns2-par02p.wns.notify.trafficmanager.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, vip3-wns2-par02p.wns.notify.trafficmanager.net, ocos-office365-s2s-msedge-net.e-0009.e-msedge.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, l-0014.l-msedge.net
                                                • Not all processes where analyzed, report is missing behavior information
                                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                • Report size getting too big, too many NtQueryValueKey calls found.

                                                Simulations

                                                Behavior and APIs

                                                TimeTypeDescription
                                                15:34:04API Interceptor726x Sleep call for process: quotation...exe modified

                                                Joe Sandbox View / Context

                                                IPs

                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                198.54.122.60SWE943211.exeGet hashmaliciousBrowse
                                                  P67mzce6yI.exeGet hashmaliciousBrowse
                                                    Gu#U00eda de carga.pdf.exeGet hashmaliciousBrowse
                                                      Pharmaceutical Inquiry.docGet hashmaliciousBrowse
                                                        deck.exeGet hashmaliciousBrowse
                                                          PO0140092021.docGet hashmaliciousBrowse
                                                            doc03633420210907151503.docGet hashmaliciousBrowse
                                                              fytfireuiwfgdcukyd.docGet hashmaliciousBrowse
                                                                quotation 21-138277.doc__.rtfGet hashmaliciousBrowse
                                                                  Pago-20210910.pdf.exeGet hashmaliciousBrowse
                                                                    Cotizaci#U00f3n-09092021.pdf.exeGet hashmaliciousBrowse
                                                                      FVS_6_09_2021_WAZTAT_NAPRWAY.exeGet hashmaliciousBrowse
                                                                        Aplieco_6635.exeGet hashmaliciousBrowse
                                                                          O4Vj9kCSBm.exeGet hashmaliciousBrowse
                                                                            ss_Alum_RFQ.docGet hashmaliciousBrowse
                                                                              MACHINE SPECIFICATION.exeGet hashmaliciousBrowse
                                                                                ASD.exeGet hashmaliciousBrowse
                                                                                  HEISCO_1212018.docGet hashmaliciousBrowse
                                                                                    fnbk9UOPUc.exeGet hashmaliciousBrowse
                                                                                      Invoice2909818233.xlsxGet hashmaliciousBrowse

                                                                                        Domains

                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                        mail.privateemail.comSWE943211.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        P67mzce6yI.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        Gu#U00eda de carga.pdf.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        Pharmaceutical Inquiry.docGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        deck.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        PO0140092021.docGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        doc03633420210907151503.docGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        fytfireuiwfgdcukyd.docGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        quotation 21-138277.doc__.rtfGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        Pago-20210910.pdf.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        Cotizaci#U00f3n-09092021.pdf.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        FVS_6_09_2021_WAZTAT_NAPRWAY.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        Aplieco_6635.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        O4Vj9kCSBm.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        ss_Alum_RFQ.docGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        MACHINE SPECIFICATION.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        ASD.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        HEISCO_1212018.docGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        fnbk9UOPUc.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        Invoice2909818233.xlsxGet hashmaliciousBrowse
                                                                                        • 198.54.122.60

                                                                                        ASN

                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                        NAMECHEAP-NETUSDlZa7n6PjI.exeGet hashmaliciousBrowse
                                                                                        • 185.61.154.7
                                                                                        SWE943211.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exeGet hashmaliciousBrowse
                                                                                        • 198.54.117.215
                                                                                        P67mzce6yI.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        Gu#U00eda de carga.pdf.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        debit.xlsxGet hashmaliciousBrowse
                                                                                        • 198.54.117.212
                                                                                        Pharmaceutical Inquiry.docGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        diagram-129.docGet hashmaliciousBrowse
                                                                                        • 198.54.124.27
                                                                                        diagram-129.docGet hashmaliciousBrowse
                                                                                        • 198.54.124.27
                                                                                        diagram-129.docGet hashmaliciousBrowse
                                                                                        • 198.54.124.27
                                                                                        deck.exeGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        diagram-477.docGet hashmaliciousBrowse
                                                                                        • 198.54.124.27
                                                                                        diagram-477.docGet hashmaliciousBrowse
                                                                                        • 198.54.124.27
                                                                                        diagram-477.docGet hashmaliciousBrowse
                                                                                        • 198.54.124.27
                                                                                        PO0140092021.docGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        I210820-0002 D1#U96a8#U6a5f-#U6d77#U95dc#U767c#U7968-R1_pdf.exeGet hashmaliciousBrowse
                                                                                        • 198.54.115.133
                                                                                        DHL-AWD6909800855.docGet hashmaliciousBrowse
                                                                                        • 104.219.248.49
                                                                                        doc03633420210907151503.docGet hashmaliciousBrowse
                                                                                        • 198.54.122.60
                                                                                        obizx.exeGet hashmaliciousBrowse
                                                                                        • 104.219.248.49
                                                                                        fytfireuiwfgdcukyd.docGet hashmaliciousBrowse
                                                                                        • 198.54.122.60

                                                                                        JA3 Fingerprints

                                                                                        No context

                                                                                        Dropped Files

                                                                                        No context

                                                                                        Created / dropped Files

                                                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\quotation...exe.log
                                                                                        Process:C:\Users\user\Desktop\quotation...exe
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:modified
                                                                                        Size (bytes):1216
                                                                                        Entropy (8bit):5.355304211458859
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                                                                        MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                                                                        SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                                                                        SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                                                                        SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                                                                        Malicious:true
                                                                                        Reputation:high, very likely benign file
                                                                                        Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                                                                        C:\Users\user\AppData\Local\Temp\tmp1BD9.tmp
                                                                                        Process:C:\Users\user\Desktop\quotation...exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1645
                                                                                        Entropy (8bit):5.17073201951906
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB6tn:cbhC7ZlNQF/rydbz9I3YODOLNdq3W
                                                                                        MD5:0C2462882F57DA016996EB425672CC4D
                                                                                        SHA1:677786D1A49CECEFCFE8DAEBFADD0C162D5B7136
                                                                                        SHA-256:A4DFB7CB88741BDB8B1C31E31AD12B55123EC7AA82A59758FC487C792B7172E4
                                                                                        SHA-512:031C1117D44A05CB188D13449EADA7DC437B838320BAEE9683D47F8B521A175E7E18BE1907F251B87486136EFDFC49094B33BB552244A0FE7207711B0AF94318
                                                                                        Malicious:true
                                                                                        Reputation:low
                                                                                        Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t
                                                                                        C:\Users\user\AppData\Roaming\pynXGlCh.exe
                                                                                        Process:C:\Users\user\Desktop\quotation...exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):699392
                                                                                        Entropy (8bit):7.458068889779674
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:nYWHCM2K4CXI/yzQs2TaIpI+QRa8t0DCUw6FYB1pja+IA1fhjgzwq5YsI:nA3CMMIpI+QH+DkKeTTzjgZI
                                                                                        MD5:A0136F82865D2E88EFA2BC913A75716C
                                                                                        SHA1:28162B2798265B1406F3C08BFF44F9B0EA50D6C4
                                                                                        SHA-256:6C5927406212482DF7AD0B2B13010541E7377AE5D392A9CC531D942872DCB22F
                                                                                        SHA-512:E001D588BDDA99FA742ECB086D26A49444B08D0D429440A0489A6284CED847CA28CE38B6AFDAF474CD212A0B5218C6767B81B3105050A661A6C15CD6BACF26B3
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: Virustotal, Detection: 22%, Browse
                                                                                        • Antivirus: ReversingLabs, Detection: 16%
                                                                                        Reputation:low
                                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'.Aa..............0..<...n.......[... ...`....@.. ....................................@.................................T[..O....`...k........................................................................... ............... ..H............text....;... ...<.................. ..`.rsrc....k...`...l...>..............@..@.reloc..............................@..B.................[......H...........\.......Q...\+.../...........................................0............}.....(.......(......r...p.(....(....o......{.....(....o......{....r...p.(....(....o......{.....(....o......{.....(....o......{.....(....o.....*...0.._........(.........(.....o............,)....t......o....r-..p(......,..o......+..(....o....(......+...*..0...........(....o....o ...o!....+..*...0..:........(.........(.....o............,.r-..p.+....t....o"....+..*...0..:........(.........(....
                                                                                        C:\Users\user\AppData\Roaming\pynXGlCh.exe:Zone.Identifier
                                                                                        Process:C:\Users\user\Desktop\quotation...exe
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):26
                                                                                        Entropy (8bit):3.95006375643621
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:ggPYV:rPYV
                                                                                        MD5:187F488E27DB4AF347237FE461A079AD
                                                                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                        Malicious:false
                                                                                        Reputation:high, very likely benign file
                                                                                        Preview: [ZoneTransfer]....ZoneId=0

                                                                                        Static File Info

                                                                                        General

                                                                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Entropy (8bit):7.458068889779674
                                                                                        TrID:
                                                                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                        • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                        • Win16/32 Executable Delphi generic (2074/23) 0.01%
                                                                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                        File name:quotation...exe
                                                                                        File size:699392
                                                                                        MD5:a0136f82865d2e88efa2bc913a75716c
                                                                                        SHA1:28162b2798265b1406f3c08bff44f9b0ea50d6c4
                                                                                        SHA256:6c5927406212482df7ad0b2b13010541e7377ae5d392a9cc531d942872dcb22f
                                                                                        SHA512:e001d588bdda99fa742ecb086d26a49444b08d0d429440a0489a6284ced847ca28ce38b6afdaf474cd212a0b5218c6767b81b3105050a661a6c15cd6bacf26b3
                                                                                        SSDEEP:12288:nYWHCM2K4CXI/yzQs2TaIpI+QRa8t0DCUw6FYB1pja+IA1fhjgzwq5YsI:nA3CMMIpI+QH+DkKeTTzjgZI
                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'.Aa..............0..<...n.......[... ...`....@.. ....................................@................................

                                                                                        File Icon

                                                                                        Icon Hash:f1f0f4d0eecccc71

                                                                                        Static PE Info

                                                                                        General

                                                                                        Entrypoint:0x4a5ba6
                                                                                        Entrypoint Section:.text
                                                                                        Digitally signed:false
                                                                                        Imagebase:0x400000
                                                                                        Subsystem:windows gui
                                                                                        Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                                                        DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                                        Time Stamp:0x61419C27 [Wed Sep 15 07:09:27 2021 UTC]
                                                                                        TLS Callbacks:
                                                                                        CLR (.Net) Version:v4.0.30319
                                                                                        OS Version Major:4
                                                                                        OS Version Minor:0
                                                                                        File Version Major:4
                                                                                        File Version Minor:0
                                                                                        Subsystem Version Major:4
                                                                                        Subsystem Version Minor:0
                                                                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                        Entrypoint Preview

                                                                                        Instruction
                                                                                        jmp dword ptr [00402000h]
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al

                                                                                        Data Directories

                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xa5b540x4f.text
                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xa60000x6b80.rsrc
                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xae0000xc.reloc
                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                        Sections

                                                                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                        .text0x20000xa3bac0xa3c00False0.822355081107data7.5296902445IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                        .rsrc0xa60000x6b800x6c00False0.44263599537data5.09104510472IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                        .reloc0xae0000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                        Resources

                                                                                        NameRVASizeTypeLanguageCountry
                                                                                        RT_ICON0xa62000x668data
                                                                                        RT_ICON0xa68780x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 1953594267, next used block 28725
                                                                                        RT_ICON0xa6b700x128GLS_BINARY_LSB_FIRST
                                                                                        RT_ICON0xa6ca80xea8data
                                                                                        RT_ICON0xa7b600x8a8dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0
                                                                                        RT_ICON0xa84180x568GLS_BINARY_LSB_FIRST
                                                                                        RT_ICON0xa89900x25a8data
                                                                                        RT_ICON0xaaf480x10a8data
                                                                                        RT_ICON0xac0000x468GLS_BINARY_LSB_FIRST
                                                                                        RT_GROUP_ICON0xac4780x84data
                                                                                        RT_VERSION0xac50c0x474data
                                                                                        RT_MANIFEST0xac9900x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                                        Imports

                                                                                        DLLImport
                                                                                        mscoree.dll_CorExeMain

                                                                                        Version Infos

                                                                                        DescriptionData
                                                                                        Translation0x0000 0x04b0
                                                                                        LegalCopyrightCopyright 2008 - 2010
                                                                                        Assembly Version1.3.0.0
                                                                                        InternalNameNullStre.exe
                                                                                        FileVersion1.3.0.0
                                                                                        CompanyNameWHC
                                                                                        LegalTrademarks
                                                                                        CommentsA little Tool where you can check the stats of your RYL - Risk Your Life - characters. Ruins of War version.
                                                                                        ProductNameRYL Character Tool - RoW EU version
                                                                                        ProductVersion1.3.0.0
                                                                                        FileDescriptionRYL Character Tool - RoW EU version
                                                                                        OriginalFilenameNullStre.exe

                                                                                        Network Behavior

                                                                                        Network Port Distribution

                                                                                        TCP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Sep 15, 2021 15:35:54.998008013 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:55.173250914 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:55.173351049 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:55.347913980 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:55.348258018 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:55.519882917 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:55.520095110 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:55.520447969 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:55.692142963 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:55.733551025 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:55.851691961 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:56.023695946 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.025326014 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.025351048 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.025366068 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.025403976 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.025552034 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:56.059699059 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:56.231317043 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.232788086 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.280301094 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:56.572989941 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:56.746912003 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.746936083 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.748061895 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:56.921089888 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.921288967 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:56.922076941 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:57.095509052 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.095813990 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.096615076 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:57.268136978 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.271565914 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.271992922 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:57.444535017 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.463848114 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.464514971 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:57.636094093 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.637113094 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.638334990 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:57.638533115 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:57.639159918 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:57.639276981 CEST49791587192.168.2.5198.54.122.60
                                                                                        Sep 15, 2021 15:35:57.809895039 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.809921026 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.810486078 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.810540915 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.908762932 CEST58749791198.54.122.60192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.952382088 CEST49791587192.168.2.5198.54.122.60

                                                                                        UDP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Sep 15, 2021 15:33:49.334690094 CEST6206053192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:33:49.364061117 CEST53620608.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:34:06.416359901 CEST6180553192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:34:06.451538086 CEST53618058.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:34:19.899344921 CEST5973653192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:34:19.902313948 CEST5105853192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:34:19.928235054 CEST53597368.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:34:19.930771112 CEST53510588.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:34:20.274862051 CEST5263653192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:34:20.301515102 CEST53526368.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:34:20.423407078 CEST5479553192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:34:20.457994938 CEST53547958.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:34:22.967668056 CEST4955753192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:34:23.000224113 CEST53495578.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:34:28.361255884 CEST6173353192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:34:28.388238907 CEST53617338.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:34:41.816943884 CEST6544753192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:34:41.849581957 CEST53654478.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:34:42.650743961 CEST5244153192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:34:42.694578886 CEST53524418.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:34:58.156965971 CEST6217653192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:34:58.209283113 CEST53621768.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:01.643830061 CEST5959653192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:01.681524992 CEST53595968.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:04.349153996 CEST6529653192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:04.377226114 CEST53652968.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:20.701389074 CEST6318353192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:20.731136084 CEST53631838.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:22.696041107 CEST6015153192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:22.731072903 CEST53601518.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:24.581577063 CEST5696953192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:24.630539894 CEST53569698.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:28.400142908 CEST5516153192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:28.429814100 CEST53551618.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:28.797866106 CEST5475753192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:28.827583075 CEST53547578.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:42.913862944 CEST4999253192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:42.944720984 CEST53499928.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:54.098917961 CEST6007553192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:54.129602909 CEST53600758.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:57.146861076 CEST5501653192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:57.174666882 CEST53550168.8.8.8192.168.2.5
                                                                                        Sep 15, 2021 15:35:58.062453985 CEST6434553192.168.2.58.8.8.8
                                                                                        Sep 15, 2021 15:35:58.090523005 CEST53643458.8.8.8192.168.2.5

                                                                                        DNS Queries

                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                        Sep 15, 2021 15:35:54.098917961 CEST192.168.2.58.8.8.80x20d9Standard query (0)mail.privateemail.comA (IP address)IN (0x0001)

                                                                                        DNS Answers

                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                        Sep 15, 2021 15:35:54.129602909 CEST8.8.8.8192.168.2.50x20d9No error (0)mail.privateemail.com198.54.122.60A (IP address)IN (0x0001)

                                                                                        SMTP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IPCommands
                                                                                        Sep 15, 2021 15:35:55.347913980 CEST58749791198.54.122.60192.168.2.5220 PrivateEmail.com prod Mail Node
                                                                                        Sep 15, 2021 15:35:55.348258018 CEST49791587192.168.2.5198.54.122.60EHLO 128757
                                                                                        Sep 15, 2021 15:35:55.520095110 CEST58749791198.54.122.60192.168.2.5250-mta-13.privateemail.com
                                                                                        250-PIPELINING
                                                                                        250-SIZE 81788928
                                                                                        250-ETRN
                                                                                        250-AUTH PLAIN LOGIN
                                                                                        250-ENHANCEDSTATUSCODES
                                                                                        250-8BITMIME
                                                                                        250-CHUNKING
                                                                                        250 STARTTLS
                                                                                        Sep 15, 2021 15:35:55.520447969 CEST49791587192.168.2.5198.54.122.60STARTTLS
                                                                                        Sep 15, 2021 15:35:55.692142963 CEST58749791198.54.122.60192.168.2.5220 Ready to start TLS

                                                                                        Code Manipulations

                                                                                        Statistics

                                                                                        CPU Usage

                                                                                        Click to jump to process

                                                                                        Memory Usage

                                                                                        Click to jump to process

                                                                                        High Level Behavior Distribution

                                                                                        Click to dive into process behavior distribution

                                                                                        Behavior

                                                                                        Click to jump to process

                                                                                        System Behavior

                                                                                        General

                                                                                        Start time:15:33:55
                                                                                        Start date:15/09/2021
                                                                                        Path:C:\Users\user\Desktop\quotation...exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:'C:\Users\user\Desktop\quotation...exe'
                                                                                        Imagebase:0x300000
                                                                                        File size:699392 bytes
                                                                                        MD5 hash:A0136F82865D2E88EFA2BC913A75716C
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:.Net C# or VB.NET
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.270468922.0000000002841000.00000004.00000001.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.271683451.0000000003A9B000.00000004.00000001.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.271683451.0000000003A9B000.00000004.00000001.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.271066231.0000000003849000.00000004.00000001.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.271066231.0000000003849000.00000004.00000001.sdmp, Author: Joe Security
                                                                                        Reputation:low

                                                                                        General

                                                                                        Start time:15:34:07
                                                                                        Start date:15/09/2021
                                                                                        Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pynXGlCh' /XML 'C:\Users\user\AppData\Local\Temp\tmp1BD9.tmp'
                                                                                        Imagebase:0x10f0000
                                                                                        File size:185856 bytes
                                                                                        MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high

                                                                                        General

                                                                                        Start time:15:34:07
                                                                                        Start date:15/09/2021
                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        Imagebase:0x7ff7ecfc0000
                                                                                        File size:625664 bytes
                                                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high

                                                                                        General

                                                                                        Start time:15:34:07
                                                                                        Start date:15/09/2021
                                                                                        Path:C:\Users\user\Desktop\quotation...exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:C:\Users\user\Desktop\quotation...exe
                                                                                        Imagebase:0x7ff797770000
                                                                                        File size:699392 bytes
                                                                                        MD5 hash:A0136F82865D2E88EFA2BC913A75716C
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:.Net C# or VB.NET
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.511804443.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000008.00000002.511804443.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.517481719.0000000003111000.00000004.00000001.sdmp, Author: Joe Security
                                                                                        Reputation:low

                                                                                        Disassembly

                                                                                        Code Analysis

                                                                                        Reset < >

                                                                                          Executed Functions

                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270385789.00000000026D0000.00000040.00000001.sdmp, Offset: 026D0000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: /67$/67$O$dR$O$dR
                                                                                          • API String ID: 0-4290964266
                                                                                          • Opcode ID: c097b69f1d772fac59c6e5a6678362dc8ffc0d1219298962d13e703a9563ab16
                                                                                          • Instruction ID: b75504055116675e0b95c10936dfc967c0f3c73258ff2228834a6acd0895be50
                                                                                          • Opcode Fuzzy Hash: c097b69f1d772fac59c6e5a6678362dc8ffc0d1219298962d13e703a9563ab16
                                                                                          • Instruction Fuzzy Hash: 2A811874E1A219DFCB08CFE5E5846ADFBB2FB89310F60A419D005AB258D7349942CF14
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270385789.00000000026D0000.00000040.00000001.sdmp, Offset: 026D0000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: v1
                                                                                          • API String ID: 0-2623884704
                                                                                          • Opcode ID: 89e160b59b3f834de8a45f6dffa7622fc859ca13d97de43e5e3caee55ad6980b
                                                                                          • Instruction ID: e67eb683337aee74472b8c683225119ad996c7e44af169bab733aef326143c03
                                                                                          • Opcode Fuzzy Hash: 89e160b59b3f834de8a45f6dffa7622fc859ca13d97de43e5e3caee55ad6980b
                                                                                          • Instruction Fuzzy Hash: 5BC10674E012089FDB18CFA5E955B9DFBB2FF89300F20942AE405BB394DB75A941CB18
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270385789.00000000026D0000.00000040.00000001.sdmp, Offset: 026D0000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: )"n
                                                                                          • API String ID: 0-293303910
                                                                                          • Opcode ID: ddaceb3b3b35af84de44a6b6d9354ad8ec396a59d8191f01edb06f588a1c2a9d
                                                                                          • Instruction ID: 8ca3d0ad4db3a7a7549c3db753aa4d36e1e98cfa9b8a81bdd4f1130932588c9d
                                                                                          • Opcode Fuzzy Hash: ddaceb3b3b35af84de44a6b6d9354ad8ec396a59d8191f01edb06f588a1c2a9d
                                                                                          • Instruction Fuzzy Hash: 1D81F574E10208DFCB08DFE5D9945AEBBB2FF89310F24952AD419AB358DB745942CF50
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270385789.00000000026D0000.00000040.00000001.sdmp, Offset: 026D0000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 07bfd2550b65688b175db1c579beeefe81e9f04b304d1ec01c63d1f9e029a044
                                                                                          • Instruction ID: bcf36dd140fe37542577f454f2fdf267cabb72f9721c86b186bc89a98a015a90
                                                                                          • Opcode Fuzzy Hash: 07bfd2550b65688b175db1c579beeefe81e9f04b304d1ec01c63d1f9e029a044
                                                                                          • Instruction Fuzzy Hash: 73C1E475E006098FCB14CFA9C584AAAB7B2BF85304F1584E9D805AF355DB31ED51CFA2
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270385789.00000000026D0000.00000040.00000001.sdmp, Offset: 026D0000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d669d1a34f9c2e657924710a627014bf7c96aa8e208cc71950fc148e0dd1c643
                                                                                          • Instruction ID: 9b0fca21fdd48d6c4c0fcd8a1ac0d1f9b40f4676541b22102e90661fe029c582
                                                                                          • Opcode Fuzzy Hash: d669d1a34f9c2e657924710a627014bf7c96aa8e208cc71950fc148e0dd1c643
                                                                                          • Instruction Fuzzy Hash: BB713570E046698BDB28CF66CC4479DBBB6AB89300F10D5AAD509A6254EB705A92CF50
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32 ref: 00D4B790
                                                                                          • GetCurrentThread.KERNEL32 ref: 00D4B7CD
                                                                                          • GetCurrentProcess.KERNEL32 ref: 00D4B80A
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00D4B863
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: Current$ProcessThread
                                                                                          • String ID:
                                                                                          • API String ID: 2063062207-0
                                                                                          • Opcode ID: 8778f4728407ad332747e9c123a38b102ae5cbb3367fcdf5699805fe0d13110f
                                                                                          • Instruction ID: 230e25d43e13e1b713502b865902076b54378f44bd01b9dfb585418631268731
                                                                                          • Opcode Fuzzy Hash: 8778f4728407ad332747e9c123a38b102ae5cbb3367fcdf5699805fe0d13110f
                                                                                          • Instruction Fuzzy Hash: 2E5144B4D007898FEB14CFA9C549BDEBBF4AF48324F24886AE409A7390D7759844CF61
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32 ref: 00D4B790
                                                                                          • GetCurrentThread.KERNEL32 ref: 00D4B7CD
                                                                                          • GetCurrentProcess.KERNEL32 ref: 00D4B80A
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00D4B863
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: Current$ProcessThread
                                                                                          • String ID:
                                                                                          • API String ID: 2063062207-0
                                                                                          • Opcode ID: 48f3810e3da696d9baa7945b28bdf7ce4d188e11e3c5a397cc0cad185e7b8270
                                                                                          • Instruction ID: bc2307e68ad3ee0a13627b903a7540dc95359e14bf511e48e0aa78d8da9df300
                                                                                          • Opcode Fuzzy Hash: 48f3810e3da696d9baa7945b28bdf7ce4d188e11e3c5a397cc0cad185e7b8270
                                                                                          • Instruction Fuzzy Hash: F55113B49006498FEB14CFA9C549BDEBBF4AF88324F248869E409A7390D7759844CB65
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 00D4968E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: HandleModule
                                                                                          • String ID:
                                                                                          • API String ID: 4139908857-0
                                                                                          • Opcode ID: fd60b78d5c7e4a38e3b77430b7b91b749cd2814e2bd2aad466358948fa8dd65b
                                                                                          • Instruction ID: f3213581b8c538f2418e15510d2b6c744bb250ff8cbce181b2869cd5cd18568e
                                                                                          • Opcode Fuzzy Hash: fd60b78d5c7e4a38e3b77430b7b91b749cd2814e2bd2aad466358948fa8dd65b
                                                                                          • Instruction Fuzzy Hash: C4711470A00B058FDB24DF6AD05179BBBF5BF88344F148A29E48AD7A50DB35E805CFA1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00D4FEAA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: CreateWindow
                                                                                          • String ID:
                                                                                          • API String ID: 716092398-0
                                                                                          • Opcode ID: dd58134d9501dbc442263ad2b1f9c08008e401b217d2868eee9ef27bd90e4e96
                                                                                          • Instruction ID: 08df8c08e2a2f6bd4f783fd84e556f6ea2576b7061c4ddb23918c3a05e523a82
                                                                                          • Opcode Fuzzy Hash: dd58134d9501dbc442263ad2b1f9c08008e401b217d2868eee9ef27bd90e4e96
                                                                                          • Instruction Fuzzy Hash: E841B0B1D10349DFDB14CF99C884ADEBBB5FF88314F24852AE819AB260D7759885CF90
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00D4FEAA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: CreateWindow
                                                                                          • String ID:
                                                                                          • API String ID: 716092398-0
                                                                                          • Opcode ID: e859affa97fcd1da57b96934f08f0bfc5dd8f4a1e0fcb839f0565d5f22f7aeb8
                                                                                          • Instruction ID: d634399b1c3d2b5a8b511bd0b87411cd18468a82862c1141f346112a1bc8b031
                                                                                          • Opcode Fuzzy Hash: e859affa97fcd1da57b96934f08f0bfc5dd8f4a1e0fcb839f0565d5f22f7aeb8
                                                                                          • Instruction Fuzzy Hash: 6C51E2B1D00349DFDB14CFA9C484ADEFBB6BF48314F24852AE419AB220D7759985CF90
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • CreateActCtxA.KERNEL32(?), ref: 00D45421
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: Create
                                                                                          • String ID:
                                                                                          • API String ID: 2289755597-0
                                                                                          • Opcode ID: 4325d3f1cee4ef7de43dd9906af8b73630cb1276757ed2ed8ac59372c59a32cc
                                                                                          • Instruction ID: e1c84c65453e50acab49c1aceaae062fca7a14827bb24957bb9e305d70a8aba2
                                                                                          • Opcode Fuzzy Hash: 4325d3f1cee4ef7de43dd9906af8b73630cb1276757ed2ed8ac59372c59a32cc
                                                                                          • Instruction Fuzzy Hash: BB41F2B0C00628CBDF24CFA9D844BCEBBB9BF48308F248569D409AB251D7B56985CF91
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D4BDE7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: DuplicateHandle
                                                                                          • String ID:
                                                                                          • API String ID: 3793708945-0
                                                                                          • Opcode ID: 4a1180774164e2e02e791f0741da85f185ddc827a69d99b0a6cef53f16de9878
                                                                                          • Instruction ID: dc9c75019827c347554fe1bdda98fe86e95c79ff101692779e85cb894ee7d811
                                                                                          • Opcode Fuzzy Hash: 4a1180774164e2e02e791f0741da85f185ddc827a69d99b0a6cef53f16de9878
                                                                                          • Instruction Fuzzy Hash: BC2114B5D002489FDB00CF9AD884ADEBFF8FB48320F14841AE915A7310D378A950CFA1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D4BDE7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: DuplicateHandle
                                                                                          • String ID:
                                                                                          • API String ID: 3793708945-0
                                                                                          • Opcode ID: 5d82476e386e84b69086dba844979b308542878055e4b00660bcf0c4ef600627
                                                                                          • Instruction ID: 9b49c0f680555a6655d15d971fd7d9bc3134aa58076c287cbb2211f981c8a7ea
                                                                                          • Opcode Fuzzy Hash: 5d82476e386e84b69086dba844979b308542878055e4b00660bcf0c4ef600627
                                                                                          • Instruction Fuzzy Hash: 2D21E2B5D002489FDB10CFAAD884ADEBFF8FB48324F14841AE915A3310D378A954CFA1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00D49709,00000800,00000000,00000000), ref: 00D4991A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad
                                                                                          • String ID:
                                                                                          • API String ID: 1029625771-0
                                                                                          • Opcode ID: 9d19b5b6891e4cb525a473752b80f6e33d4ff1a92a624d5d9653ff09bbec8a33
                                                                                          • Instruction ID: b6490853cff22a7eaffce37a83c2a054d94c35a6fd5343395d754d7ed7b67a13
                                                                                          • Opcode Fuzzy Hash: 9d19b5b6891e4cb525a473752b80f6e33d4ff1a92a624d5d9653ff09bbec8a33
                                                                                          • Instruction Fuzzy Hash: 6B11D3B69003499FDB10CF9AC444BDFFBF8EB88324F14842AE515A7600C375A945CFA5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00D49709,00000800,00000000,00000000), ref: 00D4991A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad
                                                                                          • String ID:
                                                                                          • API String ID: 1029625771-0
                                                                                          • Opcode ID: 1e4b1261ccab443d2e4826bdb859d1a8280299132a446b5dd1d7d4fca38bb2d7
                                                                                          • Instruction ID: 5bf06e98fcf4d077c3162c95de10992b2166a9f12612f8d6fc6895133827deae
                                                                                          • Opcode Fuzzy Hash: 1e4b1261ccab443d2e4826bdb859d1a8280299132a446b5dd1d7d4fca38bb2d7
                                                                                          • Instruction Fuzzy Hash: 3C11E7B6D002499FDB10CFAAD444AEEFBF4AB48324F14841ED455B7700C375A945CFA5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 00D4968E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: HandleModule
                                                                                          • String ID:
                                                                                          • API String ID: 4139908857-0
                                                                                          • Opcode ID: dd372623906f001d648b960a2e0428e48c356675727237bad6a069ef5867bea3
                                                                                          • Instruction ID: 41b46c879210443aff340e0619c663eedd327c3d4bda26735b0567e1c5f73015
                                                                                          • Opcode Fuzzy Hash: dd372623906f001d648b960a2e0428e48c356675727237bad6a069ef5867bea3
                                                                                          • Instruction Fuzzy Hash: 3711DFB6C006498FDB10CF9AC844BDFFBF8AB88324F15842AD819A7600C379A545CFA1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • PostMessageW.USER32(?,?,?,?), ref: 026D3C75
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270385789.00000000026D0000.00000040.00000001.sdmp, Offset: 026D0000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: MessagePost
                                                                                          • String ID:
                                                                                          • API String ID: 410705778-0
                                                                                          • Opcode ID: 07e1da8e9c1d325d4be2c384492b7cf4e47a1dbbf4680c0afd4178cb751a2782
                                                                                          • Instruction ID: a57619ff903dcd126d512591eacfac6057943f3d006658379d0ba3084cb464ab
                                                                                          • Opcode Fuzzy Hash: 07e1da8e9c1d325d4be2c384492b7cf4e47a1dbbf4680c0afd4178cb751a2782
                                                                                          • Instruction Fuzzy Hash: 0C11D0B5900349DFDB10CF99C984BDEBBF8EB48324F14885AE918A7700C375A994CFA1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.269555596.0000000000A5D000.00000040.00000001.sdmp, Offset: 00A5D000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: c1b3e2d9849461d2da983a85c8b6d05d1b6126587bed16e7ded25c5fc37d09be
                                                                                          • Instruction ID: 1ed60b6da20c96430597701dbc7fbb9fc7ef7014a1d2472d66df882e252c6c55
                                                                                          • Opcode Fuzzy Hash: c1b3e2d9849461d2da983a85c8b6d05d1b6126587bed16e7ded25c5fc37d09be
                                                                                          • Instruction Fuzzy Hash: AB2104B1504240EFDB25DF54D9C0B6ABF75FB88329F24C969EC050B246D336E85ACBA1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.269579468.0000000000A6D000.00000040.00000001.sdmp, Offset: 00A6D000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: ca9730be791f4b1827c59cfe2ee6e844880aa7883bb82353345f8d713907766e
                                                                                          • Instruction ID: 57e72d1911ea72e6a274dafcd57c06beb122fc608b518fa9524f5ad8b000a83b
                                                                                          • Opcode Fuzzy Hash: ca9730be791f4b1827c59cfe2ee6e844880aa7883bb82353345f8d713907766e
                                                                                          • Instruction Fuzzy Hash: 41210771A04240EFDB01DF64D9D0B66BB75FB84354F24C969D8094B341C336D856CA61
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.269579468.0000000000A6D000.00000040.00000001.sdmp, Offset: 00A6D000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 335e647300fca50ca37816fe9a366f788c719f9b0f64cec1c2c845d980a38998
                                                                                          • Instruction ID: 1add7a1ec8e0ec86aa5558f9968d63ab71d3676ff3cec9befcea4aea095d7f3d
                                                                                          • Opcode Fuzzy Hash: 335e647300fca50ca37816fe9a366f788c719f9b0f64cec1c2c845d980a38998
                                                                                          • Instruction Fuzzy Hash: 9D21F275A04240EFDB14DF64D9C4B26BB75FB88368F24C969E80A4B346C337D857CAA1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.269555596.0000000000A5D000.00000040.00000001.sdmp, Offset: 00A5D000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 74ef2d966de8d235027f0715ca3c140a7cce0e7bec94a34b65a32bd9702a0697
                                                                                          • Instruction ID: d6ea66cf3b8afcfbaa7abd95c451e54b50240a29ccf78dd65fc2e1ed238548f6
                                                                                          • Opcode Fuzzy Hash: 74ef2d966de8d235027f0715ca3c140a7cce0e7bec94a34b65a32bd9702a0697
                                                                                          • Instruction Fuzzy Hash: 7C11D076804280DFCB12CF10D9C4B16BF71FB88324F28C6A9DC450B656C33AD85ACBA2
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.269579468.0000000000A6D000.00000040.00000001.sdmp, Offset: 00A6D000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 1d0c25fe99aff34047731052aecc72f0d25ac08119bc2e0afd2376ecdf6b4289
                                                                                          • Instruction ID: c150ffcd912618cde73552b84d1afe654a2336d1f2ca97f063298f7b4d3275d5
                                                                                          • Opcode Fuzzy Hash: 1d0c25fe99aff34047731052aecc72f0d25ac08119bc2e0afd2376ecdf6b4289
                                                                                          • Instruction Fuzzy Hash: BE119075904280DFDB11CF14D5C4B15FB71FB84324F28C6A9D84A4B656C33BD85ACB61
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.269579468.0000000000A6D000.00000040.00000001.sdmp, Offset: 00A6D000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 1d0c25fe99aff34047731052aecc72f0d25ac08119bc2e0afd2376ecdf6b4289
                                                                                          • Instruction ID: c39dcc9351fe9486ba74399a85ca1c6a843787b01c75a693690848b0365abb71
                                                                                          • Opcode Fuzzy Hash: 1d0c25fe99aff34047731052aecc72f0d25ac08119bc2e0afd2376ecdf6b4289
                                                                                          • Instruction Fuzzy Hash: 3D11DD75A04280DFCB12DF20C5D0B55FBB1FB84324F28C6ADD8494B656C33AD84ACB61
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.269555596.0000000000A5D000.00000040.00000001.sdmp, Offset: 00A5D000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 68d6ab301ca7a0ff1bfbf5c9f8662f11a9c3d3c3e289b4c8abce722117d976cd
                                                                                          • Instruction ID: 637bc6b1057f9dd5849b287da0e5c456312278756fc622c08769e2876fd67a14
                                                                                          • Opcode Fuzzy Hash: 68d6ab301ca7a0ff1bfbf5c9f8662f11a9c3d3c3e289b4c8abce722117d976cd
                                                                                          • Instruction Fuzzy Hash: 3E01A7714043809AEB305F65CC84BAABBACFF49375F18855AED045E246D3799849CAB1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.269555596.0000000000A5D000.00000040.00000001.sdmp, Offset: 00A5D000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 80e923708fcf874b67599439210ef53238652fa62b5ed715903991c1c272e088
                                                                                          • Instruction ID: ec4dc2aba39d28fcbcbdddc9c572ced60b648759114a14fb41ea914c84fc3f3a
                                                                                          • Opcode Fuzzy Hash: 80e923708fcf874b67599439210ef53238652fa62b5ed715903991c1c272e088
                                                                                          • Instruction Fuzzy Hash: A7F062714043849AEB208F15CC84BA2FFA8EB85774F18C45AED085F286D3799C44CAB1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Non-executed Functions

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d0ad8efed0b1be8c65566bac813e16680096bd529de6e51a6fefe89c82e25ad8
                                                                                          • Instruction ID: 28ecde5a6bf70ac64ed224291576531b9320523bab8b766527420950f4e424c0
                                                                                          • Opcode Fuzzy Hash: d0ad8efed0b1be8c65566bac813e16680096bd529de6e51a6fefe89c82e25ad8
                                                                                          • Instruction Fuzzy Hash: 0A1280B1411F468AD710CFA5FD982893BA1B745328F904309D2A1AABF9D7F421DACF74
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: dd7d1e30f833e1f12756b63c112c793466c39e79299fe2e43409f5b1a58f001d
                                                                                          • Instruction ID: 6931ab1b617d4bed1153b8c8194870e2a9c0d3738a02895b7c09353ed53bc4d9
                                                                                          • Opcode Fuzzy Hash: dd7d1e30f833e1f12756b63c112c793466c39e79299fe2e43409f5b1a58f001d
                                                                                          • Instruction Fuzzy Hash: E1A18032E002198FCF05DFB5C8445EDBBB3FF85300B15856AE906AB261EB71E945CB60
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.270082608.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 0bc851aedcbce8df145df6d3ab96a852b4d6c3e18497cab0d029788995af72d2
                                                                                          • Instruction ID: 522d3ccf3a5b2ae1ee04708cd25ac8d444b391084463f1eaefd170f2ee9fe708
                                                                                          • Opcode Fuzzy Hash: 0bc851aedcbce8df145df6d3ab96a852b4d6c3e18497cab0d029788995af72d2
                                                                                          • Instruction Fuzzy Hash: 20C106B1811B46CAD710DFA5FD882893B61BB85328F514309D2A1AB7E8D7F421CACF74
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Executed Functions

                                                                                          APIs
                                                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,01617D19,00000800), ref: 01617DAA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000008.00000002.516316934.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad
                                                                                          • String ID: ews
                                                                                          • API String ID: 1029625771-1340174068
                                                                                          • Opcode ID: 2310708cf29cf830a00540f98ebe0937eb2ef8016c319fec0916b1e56b9825d3
                                                                                          • Instruction ID: 9cef816dbc89e9b96c10ded7c3af93bb776b66c5dad6fe907f0f4f8c55b266d0
                                                                                          • Opcode Fuzzy Hash: 2310708cf29cf830a00540f98ebe0937eb2ef8016c319fec0916b1e56b9825d3
                                                                                          • Instruction Fuzzy Hash: 9421D0B6D002499FDB10CFAAD844BEEFBF4AB88724F14852ED519A7300C375A945CFA5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,01617D19,00000800), ref: 01617DAA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000008.00000002.516316934.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad
                                                                                          • String ID: ews
                                                                                          • API String ID: 1029625771-1340174068
                                                                                          • Opcode ID: 25c22ccf90713ebdffdca128ceb6f8c12e6b8c90e5588c35d1d0959391a5a4d1
                                                                                          • Instruction ID: 3b9b4b144c0d7405cbdc5a7bdb088e77911f1212f823230b4eab0c9e37a8793a
                                                                                          • Opcode Fuzzy Hash: 25c22ccf90713ebdffdca128ceb6f8c12e6b8c90e5588c35d1d0959391a5a4d1
                                                                                          • Instruction Fuzzy Hash: 5A1103B6D002488FDB10CF9AD844BEEFBF4AB48320F54842AE515A7300C375A945CFA5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • OleInitialize.OLE32(00000000), ref: 0161B855
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000008.00000002.516316934.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: Initialize
                                                                                          • String ID: ews
                                                                                          • API String ID: 2538663250-1340174068
                                                                                          • Opcode ID: 982a4006e19bda3e5d4ae22ad1dba57922ccfd8f23b14801f2d05e7da56da387
                                                                                          • Instruction ID: fac678d3677165c79536c5e527032c30da81d4d1ad471b52aef9a217c99c35b4
                                                                                          • Opcode Fuzzy Hash: 982a4006e19bda3e5d4ae22ad1dba57922ccfd8f23b14801f2d05e7da56da387
                                                                                          • Instruction Fuzzy Hash: 991100B59006888FCB10DF9AD848BDEBBF8AB48764F248429D519A7700C379A944CFA5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          APIs
                                                                                          • OleInitialize.OLE32(00000000), ref: 0161B855
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000008.00000002.516316934.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false
                                                                                          Similarity
                                                                                          • API ID: Initialize
                                                                                          • String ID: ews
                                                                                          • API String ID: 2538663250-1340174068
                                                                                          • Opcode ID: e027e98ef30699583336947c04fdfa3c9df1306004a83e738e65ed174dab8af8
                                                                                          • Instruction ID: e8b4f4f4ec756c65dc6e18071897e900d97d7b29c54536eae898175e8696a74b
                                                                                          • Opcode Fuzzy Hash: e027e98ef30699583336947c04fdfa3c9df1306004a83e738e65ed174dab8af8
                                                                                          • Instruction Fuzzy Hash: 6D1103B59007488FDB50DF9AD848BDEBBF8EB48724F248429D519B7300D375A944CFA5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Non-executed Functions