Play interactive tour

Edit tour

Windows Analysis Report qOthJCpJ8E

Overview

General Information

Sample Name:	qOthJCpJ8E (renamed file extension from none to exe)
Analysis ID:	491500
MD5:	b0a10bd27d48fea4e569797829057892
SHA1:	5909c3383e27a1c5e7edcadd5319b31d2813df12
SHA256:	4e63cadd6aa91bc65755bd2b4035a3451cbc4854ed2817ac08941919f892f7e7
Tags:	32AgentTeslaexetrojan
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for domain / URL

Installs a global keyboard hook

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

.NET source code contains very large strings

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

qOthJCpJ8E.exe (PID: 6764 cmdline: 'C:\Users\user\Desktop\qOthJCpJ8E.exe' MD5: B0A10BD27D48FEA4E569797829057892)

qOthJCpJ8E.exe (PID: 6916 cmdline: C:\Users\user\Desktop\qOthJCpJ8E.exe MD5: B0A10BD27D48FEA4E569797829057892)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "admin@airseaalliance.com", "Password": "CIRcumFerted221", "Host": "mail.airseaalliance.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.601109843.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.601109843.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000002.00000002.354431528.0000000002911000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000002.354577262.000000000298D000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000002.355601283.0000000003911000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.355601283.0000000003911000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: qOthJCpJ8E.exe PID: 6764	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: qOthJCpJ8E.exe PID: 6764	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: qOthJCpJ8E.exe PID: 6916	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: qOthJCpJ8E.exe PID: 6916	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.qOthJCpJ8E.exe.39e8810.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.qOthJCpJ8E.exe.39e8810.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.qOthJCpJ8E.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.qOthJCpJ8E.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
2.2.qOthJCpJ8E.exe.3b18b90.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.qOthJCpJ8E.exe.3b18b90.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
2.2.qOthJCpJ8E.exe.296859c.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
2.2.qOthJCpJ8E.exe.39e8810.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.qOthJCpJ8E.exe.39e8810.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 4 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 2.2.qOthJCpJ8E.exe.39e8810.4.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "admin@airseaalliance.com", "Password": "CIRcumFerted221", "Host": "mail.airseaalliance.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: qOthJCpJ8E.exe	Virustotal: Detection: 24%			Perma Link
Source: qOthJCpJ8E.exe	ReversingLabs: Detection: 22%

Multi AV Scanner detection for domain / URL

Show sources

Source: airseaalliance.com

Virustotal: Detection: 11%

Perma Link

Source: 4.2.qOthJCpJ8E.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: qOthJCpJ8E.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: qOthJCpJ8E.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.6:49804 -> 135.181.211.109:587

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

IP Address: 135.181.211.109 135.181.211.109

Source: global traffic

TCP traffic: 192.168.2.6:49804 -> 135.181.211.109:587

Source: global traffic

TCP traffic: 192.168.2.6:49804 -> 135.181.211.109:587

Source: qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	String found in binary or memory: http://NKPyoe.com
Source: qOthJCpJ8E.exe, 00000004.00000002.609099464.0000000002EEE000.00000004.00000001.sdmp	String found in binary or memory: http://airseaalliance.com
Source: qOthJCpJ8E.exe, 00000004.00000002.609055198.0000000002EE4000.00000004.00000001.sdmp, qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp, qOthJCpJ8E.exe, 00000004.00000002.609182262.0000000002EFC000.00000004.00000001.sdmp, qOthJCpJ8E.exe, 00000004.00000002.609099464.0000000002EEE000.00000004.00000001.sdmp	String found in binary or memory: http://b1mW8jjfSsi.com
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: qOthJCpJ8E.exe, 00000004.00000002.609099464.0000000002EEE000.00000004.00000001.sdmp	String found in binary or memory: http://mail.airseaalliance.com
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: qOthJCpJ8E.exe, 00000002.00000003.344939105.0000000000D6D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-joAy
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: qOthJCpJ8E.exe	String found in binary or memory: http://www.rspb.org.uk/wildlife/birdguide/name/
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%
Source: qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: qOthJCpJ8E.exe, 00000002.00000002.355601283.0000000003911000.00000004.00000001.sdmp, qOthJCpJ8E.exe, 00000004.00000002.601109843.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: mail.airseaalliance.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\qOthJCpJ8E.exe

Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 4.2.qOthJCpJ8E.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bFCF4D28Cu002d7E2Bu002d4479u002d87E8u002dBA9F53AFCDF6u007d/A57FD5A0u002d5234u002d4B4Cu002dADC4u002dB1B12C4B9358.cs

Large array initialization: .cctor: array initializer size 11965

.NET source code contains very large strings

Show sources

Source: qOthJCpJ8E.exe, Darwin.WindowsForm/SearchResults.cs	Long String: Length: 34816
Source: 2.0.qOthJCpJ8E.exe.370000.0.unpack, Darwin.WindowsForm/SearchResults.cs	Long String: Length: 34816
Source: 2.2.qOthJCpJ8E.exe.370000.0.unpack, Darwin.WindowsForm/SearchResults.cs	Long String: Length: 34816
Source: 4.2.qOthJCpJ8E.exe.770000.1.unpack, Darwin.WindowsForm/SearchResults.cs	Long String: Length: 34816
Source: 4.0.qOthJCpJ8E.exe.770000.0.unpack, Darwin.WindowsForm/SearchResults.cs	Long String: Length: 34816

Source: qOthJCpJ8E.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 2_2_00D4C194	2_2_00D4C194
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 2_2_00D4E5F0	2_2_00D4E5F0
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 2_2_00D4E5E0	2_2_00D4E5E0
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C5C160	4_2_00C5C160
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C52D00	4_2_00C52D00
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C58D30	4_2_00C58D30
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C516F0	4_2_00C516F0
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C55660	4_2_00C55660
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C5C150	4_2_00C5C150
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C5B108	4_2_00C5B108
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C6E2E0	4_2_00C6E2E0
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C654F0	4_2_00C654F0
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C610A0	4_2_00C610A0
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C60040	4_2_00C60040
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C64C50	4_2_00C64C50
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C6F03F	4_2_00C6F03F
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C6B348	4_2_00C6B348
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C6C470	4_2_00C6C470
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C639E0	4_2_00C639E0
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00F646A0	4_2_00F646A0
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00F645B0	4_2_00F645B0
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00F64690	4_2_00F64690

Source: qOthJCpJ8E.exe, 00000002.00000002.354759570.0000000002A41000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameColladaLoader.dll4 vs qOthJCpJ8E.exe
Source: qOthJCpJ8E.exe, 00000002.00000002.354431528.0000000002911000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamegEneauOKEZEdTpbQwHqNSSmzLDmq.exe4 vs qOthJCpJ8E.exe
Source: qOthJCpJ8E.exe, 00000002.00000002.358534563.0000000006FC0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs qOthJCpJ8E.exe
Source: qOthJCpJ8E.exe, 00000002.00000002.353246719.0000000000440000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameContractArgumentValidatorAttribu.exe4 vs qOthJCpJ8E.exe
Source: qOthJCpJ8E.exe, 00000004.00000002.601109843.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamegEneauOKEZEdTpbQwHqNSSmzLDmq.exe4 vs qOthJCpJ8E.exe
Source: qOthJCpJ8E.exe, 00000004.00000000.352344430.0000000000840000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameContractArgumentValidatorAttribu.exe4 vs qOthJCpJ8E.exe
Source: qOthJCpJ8E.exe, 00000004.00000002.601596246.00000000009D8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs qOthJCpJ8E.exe
Source: qOthJCpJ8E.exe	Binary or memory string: OriginalFilenameContractArgumentValidatorAttribu.exe4 vs qOthJCpJ8E.exe

Source: qOthJCpJ8E.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: qOthJCpJ8E.exe	Virustotal: Detection: 24%
Source: qOthJCpJ8E.exe	ReversingLabs: Detection: 22%

Source: qOthJCpJ8E.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\qOthJCpJ8E.exe 'C:\Users\user\Desktop\qOthJCpJ8E.exe'
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process created: C:\Users\user\Desktop\qOthJCpJ8E.exe C:\Users\user\Desktop\qOthJCpJ8E.exe
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process created: C:\Users\user\Desktop\qOthJCpJ8E.exe C:\Users\user\Desktop\qOthJCpJ8E.exe	Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qOthJCpJ8E.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/1

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: 4.2.qOthJCpJ8E.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.qOthJCpJ8E.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: qOthJCpJ8E.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: qOthJCpJ8E.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: qOthJCpJ8E.exe, Darwin.WindowsForm/MainForm.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.qOthJCpJ8E.exe.370000.0.unpack, Darwin.WindowsForm/MainForm.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.qOthJCpJ8E.exe.370000.0.unpack, Darwin.WindowsForm/MainForm.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.qOthJCpJ8E.exe.770000.1.unpack, Darwin.WindowsForm/MainForm.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.qOthJCpJ8E.exe.770000.0.unpack, Darwin.WindowsForm/MainForm.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C58B65 push esp; iretd		4_2_00C58B66
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Code function: 4_2_00C6BD52 push eax; ret		4_2_00C6BD59

Source: initial sample

Static PE information: section name: .text entropy: 7.07581849985

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 2.2.qOthJCpJ8E.exe.296859c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.354431528.0000000002911000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.354577262.000000000298D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qOthJCpJ8E.exe PID: 6764, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: qOthJCpJ8E.exe, 00000002.00000002.354577262.000000000298D000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: qOthJCpJ8E.exe, 00000002.00000002.354577262.000000000298D000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe TID: 6768	Thread sleep time: -35515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe TID: 6816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe TID: 7072	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe TID: 7076	Thread sleep count: 1879 > 30	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe TID: 7076	Thread sleep count: 7961 > 30	Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Window / User API: threadDelayed 1879			Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Window / User API: threadDelayed 7961			Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Thread delayed: delay time: 35515	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: qOthJCpJ8E.exe, 00000002.00000002.354577262.000000000298D000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: qOthJCpJ8E.exe, 00000002.00000002.354577262.000000000298D000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: qOthJCpJ8E.exe, 00000002.00000002.354577262.000000000298D000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: qOthJCpJ8E.exe, 00000002.00000002.354577262.000000000298D000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Code function: 4_2_00C51FA8 LdrInitializeThunk,

4_2_00C51FA8

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Memory written: C:\Users\user\Desktop\qOthJCpJ8E.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Process created: C:\Users\user\Desktop\qOthJCpJ8E.exe C:\Users\user\Desktop\qOthJCpJ8E.exe

Jump to behavior

Source: qOthJCpJ8E.exe, 00000004.00000002.607570784.0000000001670000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: qOthJCpJ8E.exe, 00000004.00000002.607570784.0000000001670000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: qOthJCpJ8E.exe, 00000004.00000002.607570784.0000000001670000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: qOthJCpJ8E.exe, 00000004.00000002.607570784.0000000001670000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Users\user\Desktop\qOthJCpJ8E.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Users\user\Desktop\qOthJCpJ8E.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 2.2.qOthJCpJ8E.exe.39e8810.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.qOthJCpJ8E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.qOthJCpJ8E.exe.3b18b90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.qOthJCpJ8E.exe.39e8810.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.601109843.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.355601283.0000000003911000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qOthJCpJ8E.exe PID: 6764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qOthJCpJ8E.exe PID: 6916, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\qOthJCpJ8E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qOthJCpJ8E.exe PID: 6916, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 2.2.qOthJCpJ8E.exe.39e8810.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.qOthJCpJ8E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.qOthJCpJ8E.exe.3b18b90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.qOthJCpJ8E.exe.39e8810.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.601109843.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.355601283.0000000003911000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qOthJCpJ8E.exe PID: 6764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qOthJCpJ8E.exe PID: 6916, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Input Capture11	Security Software Discovery211	Remote Desktop Protocol	Input Capture11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Credentials in Registry1	Process Discovery2	SMB/Windows Admin Shares	Archive Collected Data11	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Data from Local System2	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing12	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
qOthJCpJ8E.exe	25%	Virustotal		Browse
qOthJCpJ8E.exe	22%	ReversingLabs	ByteCode-MSIL.Trojan.Taskun

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.qOthJCpJ8E.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
airseaalliance.com	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.rspb.org.uk/wildlife/birdguide/name/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://airseaalliance.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://b1mW8jjfSsi.com	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://NKPyoe.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://mail.airseaalliance.com	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://api.ipify.org%	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
airseaalliance.com	135.181.211.109	true	true	11%, Virustotal, Browse	unknown
mail.airseaalliance.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.rspb.org.uk/wildlife/birdguide/name/	qOthJCpJ8E.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.tiro.com	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-joAy	qOthJCpJ8E.exe, 00000002.00000003.344939105.0000000000D6D000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://airseaalliance.com	qOthJCpJ8E.exe, 00000004.00000002.609099464.0000000002EEE000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://b1mW8jjfSsi.com	qOthJCpJ8E.exe, 00000004.00000002.609055198.0000000002EE4000.00000004.00000001.sdmp, qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp, qOthJCpJ8E.exe, 00000004.00000002.609182262.0000000002EFC000.00000004.00000001.sdmp, qOthJCpJ8E.exe, 00000004.00000002.609099464.0000000002EEE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://NKPyoe.com	qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false		high
https://api.ipify.org%GETMozilla/5.0	qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	false	URL Reputation: safe	low
http://www.fonts.com	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://mail.airseaalliance.com	qOthJCpJ8E.exe, 00000004.00000002.609099464.0000000002EEE000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	qOthJCpJ8E.exe, 00000002.00000002.357282408.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%	qOthJCpJ8E.exe, 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	qOthJCpJ8E.exe, 00000002.00000002.355601283.0000000003911000.00000004.00000001.sdmp, qOthJCpJ8E.exe, 00000004.00000002.601109843.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
135.181.211.109	airseaalliance.com	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491500
Start date:	27.09.2021
Start time:	16:39:39
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	qOthJCpJ8E (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.5% (good quality ratio 0.4%) Quality average: 60.2% Quality standard deviation: 30.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 33 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 2.18.108.150, 93.184.220.29, 20.82.210.154, 23.0.174.200, 23.0.174.185, 20.54.110.249, 40.112.88.60, 23.10.249.43, 23.10.249.26, 95.100.54.203, 20.50.102.62 Excluded domains from analysis (whitelisted): cs9.wac.phicdn.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, cdn.onenote.net.edgekey.net, ocsp.digicert.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e1553.dspg.akamaiedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:40:40	API Interceptor	706x Sleep call for process: qOthJCpJ8E.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
135.181.211.109	Reciept_02737279293.exe	Get hash	malicious	Browse	airseaalliance.com/wp-admin/lib/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
airseaalliance.com	Reciept_02737279293.exe	Get hash	malicious	Browse	135.181.211.109
	0939489392303224233.exe	Get hash	malicious	Browse	198.136.51.123
	0939489392303224233.exe	Get hash	malicious	Browse	198.136.51.123
	NEW URGENT ORDER FROM PUK ITALIA GROUP SRL.EXE	Get hash	malicious	Browse	198.136.51.123
	cap.exe	Get hash	malicious	Browse	198.136.51.123
	USD67,884.08_Payment_Advise_9083008849.exe	Get hash	malicious	Browse	198.136.51.123

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	7XmWGse79x.exe	Get hash	malicious	Browse	88.99.75.82
	m5W1BZQU4m.exe	Get hash	malicious	Browse	88.99.75.82
	hHsIHUGICB.exe	Get hash	malicious	Browse	88.99.75.82
	NOgYb2fHbO.exe	Get hash	malicious	Browse	88.99.75.82
	vKTd7I2OdfBzkW2.exe	Get hash	malicious	Browse	136.243.159.53
	VwDvbAowp0.exe	Get hash	malicious	Browse	88.99.75.82
	lXy3MnXJ83.exe	Get hash	malicious	Browse	88.99.75.82
	SebwAujas5.exe	Get hash	malicious	Browse	88.99.75.82
	nxW9yUgdYM.exe	Get hash	malicious	Browse	88.99.75.82
	Ov3tXE6rdw.exe	Get hash	malicious	Browse	168.119.93.163
	cxBR3cCGTw.exe	Get hash	malicious	Browse	88.99.75.82
	Confirmation de cdeclient_5045009.xlsx	Get hash	malicious	Browse	168.119.93.163
	KI7JhXnhm9.exe	Get hash	malicious	Browse	136.243.159.53
	k5THcVgINl.exe	Get hash	malicious	Browse	88.99.75.82
	b2i2IopgOC.exe	Get hash	malicious	Browse	88.99.75.82
	G2BPn4a7o1.exe	Get hash	malicious	Browse	88.99.75.82
	New Price List.xlsx	Get hash	malicious	Browse	136.243.159.53
	qOsCIQD1uR.exe	Get hash	malicious	Browse	88.99.75.82
	FedEx Shipment Documents.exe	Get hash	malicious	Browse	136.243.159.53
	NC7bm1PoKj.exe	Get hash	malicious	Browse	88.99.75.82

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qOthJCpJ8E.exe.log Download File
Process:	C:\Users\user\Desktop\qOthJCpJ8E.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1309
Entropy (8bit):	5.3528008810928345
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84aE4Ks:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzg
MD5:	542338C5A30B02E372089FECDC54D607
SHA1:	6FAD29FF14686FC847B160E876C1E078333F6DCB
SHA-256:	6CEA4E70947B962733754346CE49553BE3FB6E1FB3949C29EC22FA9CA4B7E7B6
SHA-512:	FE4431305A8958C4940EB4AC65723A38DA6057C3D30F789C6EDDEBA8962B62E9C0583254E74740855027CF3AE9315E3001A7EEB54168073ED0D2AB9B1F05503A
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.8234614068068815
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	qOthJCpJ8E.exe
File size:	882176
MD5:	b0a10bd27d48fea4e569797829057892
SHA1:	5909c3383e27a1c5e7edcadd5319b31d2813df12
SHA256:	4e63cadd6aa91bc65755bd2b4035a3451cbc4854ed2817ac08941919f892f7e7
SHA512:	76434b2b0731013ab311035f84986b9385ec2db89c178e74e7f7ec0987bbcfefebe4202756b50c922b30c5e69cc02c2bec4f92687b960cd299c5c4cb0521d290
SSDEEP:	12288:fycRcIcGRiuoBQnxcsDA7Mg+Svq4DPp9KDwu43oO3yYeQEi2RA/2xYBSzz2DNBcF:n2IFjF+3e+vms2bC/UP1QHeF+G
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&Qa..............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	138e8eccece8cccc

Static PE Info

General
Entrypoint:	0x4bfade
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6151269F [Mon Sep 27 02:04:15 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbfa8c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x19484	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xda000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbdae4	0xbdc00	False	0.686987915843	data	7.07581849985	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x19484	0x19600	False	0.391895012315	data	4.29878052475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xda000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xc0180	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0xd09b8	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0xd4bf0	0x25a8	data
RT_ICON	0xd71a8	0x10a8	data
RT_ICON	0xd8260	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xd86d8	0x4c	data
RT_VERSION	0xd8734	0x38c	PGP symmetric key encrypted data - Plaintext or unencrypted data
RT_MANIFEST	0xd8ad0	0x9b0	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright F@Soft
Assembly Version	1.0.6.2
InternalName	ContractArgumentValidatorAttribu.exe
FileVersion	1.0.6.0
CompanyName	F@Soft
LegalTrademarks
Comments
ProductName	Darwin AW
ProductVersion	1.0.6.0
FileDescription	Darwin AW
OriginalFilename	ContractArgumentValidatorAttribu.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/27/21-16:42:31.140086	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49804	587	192.168.2.6	135.181.211.109

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 16:42:30.611304998 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:30.663005114 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:30.663153887 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:30.791960001 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:30.792556047 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:30.846227884 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:30.849085093 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:30.901623964 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:30.902833939 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:30.967454910 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:30.968766928 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:31.021490097 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:31.022263050 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:31.085663080 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:31.086240053 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:31.138077021 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:31.138175011 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:31.140085936 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:31.140113115 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:31.140911102 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:31.141004086 CEST	49804	587	192.168.2.6	135.181.211.109
Sep 27, 2021 16:42:31.192779064 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:31.193581104 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:31.194349051 CEST	587	49804	135.181.211.109	192.168.2.6
Sep 27, 2021 16:42:31.235061884 CEST	49804	587	192.168.2.6	135.181.211.109

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 16:40:57.261178017 CEST	63791	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:40:57.279398918 CEST	53	63791	8.8.8.8	192.168.2.6
Sep 27, 2021 16:40:58.150991917 CEST	64267	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:40:58.164597034 CEST	53	64267	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:00.153673887 CEST	49448	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:00.167629004 CEST	53	49448	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:19.366343021 CEST	60342	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:19.396732092 CEST	53	60342	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:20.325140953 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:20.394782066 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:20.943948984 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:20.958260059 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:21.445349932 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:21.545151949 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:21.903871059 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:21.919315100 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:21.987421036 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:22.000401020 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:22.380311012 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:22.393881083 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:22.796385050 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:22.809679031 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:23.215997934 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:23.310338974 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:24.006201029 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:24.019093037 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:25.469414949 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:25.483047009 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:25.909734011 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:25.922770023 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 27, 2021 16:41:37.814781904 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:41:37.833616018 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 27, 2021 16:42:02.722985029 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:42:02.789666891 CEST	53	50055	8.8.8.8	192.168.2.6
Sep 27, 2021 16:42:08.505712032 CEST	61374	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:42:08.518668890 CEST	53	61374	8.8.8.8	192.168.2.6
Sep 27, 2021 16:42:09.618330956 CEST	50339	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:42:09.652004957 CEST	53	50339	8.8.8.8	192.168.2.6
Sep 27, 2021 16:42:30.037147045 CEST	63307	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:42:30.094520092 CEST	53	63307	8.8.8.8	192.168.2.6
Sep 27, 2021 16:42:30.419327974 CEST	49694	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:42:30.478144884 CEST	53	49694	8.8.8.8	192.168.2.6
Sep 27, 2021 16:42:41.668550014 CEST	54982	53	192.168.2.6	8.8.8.8
Sep 27, 2021 16:42:41.700897932 CEST	53	54982	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 27, 2021 16:42:30.037147045 CEST	192.168.2.6	8.8.8.8	0x509	Standard query (0)	mail.airseaalliance.com	A (IP address)	IN (0x0001)
Sep 27, 2021 16:42:30.419327974 CEST	192.168.2.6	8.8.8.8	0xebd	Standard query (0)	mail.airseaalliance.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 27, 2021 16:42:30.094520092 CEST	8.8.8.8	192.168.2.6	0x509	No error (0)	mail.airseaalliance.com	airseaalliance.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 16:42:30.094520092 CEST	8.8.8.8	192.168.2.6	0x509	No error (0)	airseaalliance.com		135.181.211.109	A (IP address)	IN (0x0001)
Sep 27, 2021 16:42:30.478144884 CEST	8.8.8.8	192.168.2.6	0xebd	No error (0)	mail.airseaalliance.com	airseaalliance.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 16:42:30.478144884 CEST	8.8.8.8	192.168.2.6	0xebd	No error (0)	airseaalliance.com		135.181.211.109	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 27, 2021 16:42:30.791960001 CEST	587	49804	135.181.211.109	192.168.2.6	220-lin90.itlinks.com ESMTP Exim 4.94.2 #2 Mon, 27 Sep 2021 16:42:30 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Sep 27, 2021 16:42:30.792556047 CEST	49804	587	192.168.2.6	135.181.211.109	EHLO 302494
Sep 27, 2021 16:42:30.846227884 CEST	587	49804	135.181.211.109	192.168.2.6	250-lin90.itlinks.com Hello 302494 [185.189.150.72] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Sep 27, 2021 16:42:30.849085093 CEST	49804	587	192.168.2.6	135.181.211.109	AUTH login YWRtaW5AYWlyc2VhYWxsaWFuY2UuY29t
Sep 27, 2021 16:42:30.901623964 CEST	587	49804	135.181.211.109	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2021 16:42:30.967454910 CEST	587	49804	135.181.211.109	192.168.2.6	235 Authentication succeeded
Sep 27, 2021 16:42:30.968766928 CEST	49804	587	192.168.2.6	135.181.211.109	MAIL FROM:<admin@airseaalliance.com>
Sep 27, 2021 16:42:31.021490097 CEST	587	49804	135.181.211.109	192.168.2.6	250 OK
Sep 27, 2021 16:42:31.022263050 CEST	49804	587	192.168.2.6	135.181.211.109	RCPT TO:<admin@airseaalliance.com>
Sep 27, 2021 16:42:31.085663080 CEST	587	49804	135.181.211.109	192.168.2.6	250 Accepted
Sep 27, 2021 16:42:31.086240053 CEST	49804	587	192.168.2.6	135.181.211.109	DATA
Sep 27, 2021 16:42:31.138175011 CEST	587	49804	135.181.211.109	192.168.2.6	354 Enter message, ending with "." on a line by itself
Sep 27, 2021 16:42:31.141004086 CEST	49804	587	192.168.2.6	135.181.211.109	.
Sep 27, 2021 16:42:31.194349051 CEST	587	49804	135.181.211.109	192.168.2.6	250 OK id=1mUrpw-00Fj3O-17

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: qOthJCpJ8E.exe PID: 6764 Parent PID: 3864

General

Start time:	16:40:32
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\qOthJCpJ8E.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\qOthJCpJ8E.exe'
Imagebase:	0x370000
File size:	882176 bytes
MD5 hash:	B0A10BD27D48FEA4E569797829057892
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000002.00000002.354431528.0000000002911000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000002.00000002.354577262.000000000298D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.355601283.0000000003911000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000002.00000002.355601283.0000000003911000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: qOthJCpJ8E.exe PID: 6916 Parent PID: 6764

General

Start time:	16:40:41
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\qOthJCpJ8E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\qOthJCpJ8E.exe
Imagebase:	0x770000
File size:	882176 bytes
MD5 hash:	B0A10BD27D48FEA4E569797829057892
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.607696805.0000000002B81000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.601109843.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.601109843.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: qOthJCpJ8E.exe PID: 6764 Parent PID: 3864 qOthJCpJ8E.exeCOMMON

Executed Functions

Function 00D49410, Relevance: 1.7, APIs: 1, Instructions: 192COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D49656

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: abcbce14ccb7e7117643ece3a744ef07355364e78d974c8f5d1991b433e340a3
Instruction ID: de8448eab8ffccba2f122af78efbbef421b76dd32e5c147580989bc109a0897d
Opcode Fuzzy Hash: abcbce14ccb7e7117643ece3a744ef07355364e78d974c8f5d1991b433e340a3
Instruction Fuzzy Hash: 727114B0A00B058FDB24DF6AD05179AB7F5BB88314F14892DE44ADBA40DB75E906CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4DE80, Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633753ba230fdbe05a0c7b6832e77c708518d1c8ed81a9aa11fcd54a8c2483a9
Instruction ID: 0c79d0948d5e0a4b96d641df3f0a946bdefaff15cc4a5455c489faafc7ca418b
Opcode Fuzzy Hash: 633753ba230fdbe05a0c7b6832e77c708518d1c8ed81a9aa11fcd54a8c2483a9
Instruction Fuzzy Hash: 635133B1C00349DFDB11CFA9C880ADEBFB1BF48314F25852AE415AB221D774A885CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D4DE20, Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00D4FE8A

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: eff379554f620ee9634346a9ceed135e451e97a2189beaad9ee9dad3cc1893d9
Instruction ID: bc365ed8a89ddb81f43c41de3a6596f4820e340652230ba9381d409535bde6c5
Opcode Fuzzy Hash: eff379554f620ee9634346a9ceed135e451e97a2189beaad9ee9dad3cc1893d9
Instruction Fuzzy Hash: 3551F1B1C00348DFDB15CFA9C880ADEBFB5BF48314F25852AE415AB221D7759985CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D4FD6C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00D4FE8A

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5841ea4e739223cf20d43037c4928db9c30d943f756d77d77d00096c1c1d6f36
Instruction ID: f809d094a3f3152b9675f320992748286ff7f56a1187f5c803354366be71472c
Opcode Fuzzy Hash: 5841ea4e739223cf20d43037c4928db9c30d943f756d77d77d00096c1c1d6f36
Instruction Fuzzy Hash: E951C0B1D00309DFDB14CF99C881ADEBBB5BF48314F24852AE819AB260D775A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00D4DE3C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00D4FE8A

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3a7be24d4e924741506c17209d60c1596a5bf6e9e25a36785e12d3b0b50dbddc
Instruction ID: 2c66450928eed07d12cc9e801372715e19f9705d4e8c4b6d3dbfbff2fbf9ca18
Opcode Fuzzy Hash: 3a7be24d4e924741506c17209d60c1596a5bf6e9e25a36785e12d3b0b50dbddc
Instruction Fuzzy Hash: 1451B2B1D003499FDF14CF99C884ADEBBB5FF48314F24852AE419AB260D7759945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00D45364, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00D45421

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 00bc60f30308ae5107969b764ad6f92b7849a90080fae92954e2eefdb1414fb8
Instruction ID: 29cef217425db74403035a753cedf4e97cf6a6be01683ab11fe8ab4c5d2f8a64
Opcode Fuzzy Hash: 00bc60f30308ae5107969b764ad6f92b7849a90080fae92954e2eefdb1414fb8
Instruction Fuzzy Hash: B9410571C00618CFDB24DFA9D8447DDBBF5BF48308F248469D408AB255E775698ACF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D43E40, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00D45421

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 21b974592042031930872978f501ba968968af6330ea23786f798c7d296a0bd8
Instruction ID: 620702ececf44bcb22b611fd50d57b4b1fc5edec7218fcf3d808c9e5d935cdca
Opcode Fuzzy Hash: 21b974592042031930872978f501ba968968af6330ea23786f798c7d296a0bd8
Instruction Fuzzy Hash: 3441D471C00618CFDB24DFA9C8447DEBBF5BF49308F248569D408AB255E7766989CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04E5E954, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,04E5EF9D,?,?), ref: 04E5F04F

Memory Dump Source

Source File: 00000002.00000002.356356503.0000000004E50000.00000040.00000001.sdmp, Offset: 04E50000, based on PE: false

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 8853d27e118f4ff087a7b319c34e559a7ebc57ab77fc80fc13575b3d4a617020
Instruction ID: 58adafa37141fae7d8a0b8ae251e44912b27d78e0073fa027dd85c09a2b4099b
Opcode Fuzzy Hash: 8853d27e118f4ff087a7b319c34e559a7ebc57ab77fc80fc13575b3d4a617020
Instruction Fuzzy Hash: FF31C5B5D002099FDB10CF99D884ADEFBF9FB48324F18842AE915A7310D775A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4A134, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00D4B8FE,?,?,?,?,?), ref: 00D4B9BF

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b58e59f977830476edec6806b9765486545bdff4332712ffaaaccf662fcd3f22
Instruction ID: 9e5413603793baa59ee7573253343e4fc33e80411eb6c5fb2abee69bf2c7c58c
Opcode Fuzzy Hash: b58e59f977830476edec6806b9765486545bdff4332712ffaaaccf662fcd3f22
Instruction Fuzzy Hash: AD21E4B5900248AFDB10CF9AD484AEEBBF8FB48324F14841AE914A7310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4B930, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00D4B8FE,?,?,?,?,?), ref: 00D4B9BF

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7dd58a6a03a579bfe577f1b30456366b48585933033d896983b06fd920a73abf
Instruction ID: 14d1cbf04b6486f37447cf1aa3de88da56cb326d0c41455441d56a4837401337
Opcode Fuzzy Hash: 7dd58a6a03a579bfe577f1b30456366b48585933033d896983b06fd920a73abf
Instruction Fuzzy Hash: 4F21E2B5D00249DFDB00CFA9D484ADEBBF9FB48324F14841AE914A7310D778A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D48780, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00D496D1,00000800,00000000,00000000), ref: 00D498E2

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 62573f57029ec170605b4ba459f55c6786cd23a7af2f3231eba1f097b3101c52
Instruction ID: 896f83e3f7528e180e218390451e9a681369063f54e8546582998623cdb67335
Opcode Fuzzy Hash: 62573f57029ec170605b4ba459f55c6786cd23a7af2f3231eba1f097b3101c52
Instruction Fuzzy Hash: 031103B6D002499FDB10CF9AC444ADFFBF8EB89324F14842AE419A7200C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D49873, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00D496D1,00000800,00000000,00000000), ref: 00D498E2

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dab59a71d1d55616385508909461e319789ad174e89e0f307f5a42c56e3f4dbe
Instruction ID: 4bb3f24ad0605967c996fac7d2bf3240c78d1a2674841df5096a105c54452b0d
Opcode Fuzzy Hash: dab59a71d1d55616385508909461e319789ad174e89e0f307f5a42c56e3f4dbe
Instruction Fuzzy Hash: 5111F6B6D002499FDB10CF9AD484ADFFBF4EB89324F14842AD419A7600D775A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D495F0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D49656

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3c9f47cd4e27fb27984a79d419a53382f36f80562699371651e5426d3422d2e6
Instruction ID: b030c3e4a400c9704434fbd05882329aeb987939616114d1b2bc249d1dfca886
Opcode Fuzzy Hash: 3c9f47cd4e27fb27984a79d419a53382f36f80562699371651e5426d3422d2e6
Instruction Fuzzy Hash: AA11DFB5C006498FCB20CF9AD444ADFFBF8AB89324F19842AD429A7600D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.353897722.0000000000C4D000.00000040.00000001.sdmp, Offset: 00C4D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac6a346870bf375784039a96ae4a0ac9c361c1d757bb922625df4a9ae59c2e1
Instruction ID: a9c1bb6c8ef943322dfc4c153ed53297d241539d1c82c79ee660f4d6b85483b4
Opcode Fuzzy Hash: 8ac6a346870bf375784039a96ae4a0ac9c361c1d757bb922625df4a9ae59c2e1
Instruction Fuzzy Hash: 94212971604200DFDB11EF50D5C0B16BBA5FB84328F24CAADE80A4B346C3B6DC56CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.353897722.0000000000C4D000.00000040.00000001.sdmp, Offset: 00C4D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4de00ea1b0c7666734173beaa7ff4ae9aed85550a0b569ec21103e80134a097
Instruction ID: 91228be34a266637b7ce67fda01fb46d3b13f4c567c814f1cf82b2d5e3aefc72
Opcode Fuzzy Hash: f4de00ea1b0c7666734173beaa7ff4ae9aed85550a0b569ec21103e80134a097
Instruction Fuzzy Hash: 1A21F271604240DFDB14EF50D9C4B16BB65FB84324F24C9AEE80A4B246C33AD856CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.353897722.0000000000C4D000.00000040.00000001.sdmp, Offset: 00C4D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770c7217069deaf535aca921faf004fe4184be8004e6e6e6d4d102fb4435b2a9
Instruction ID: 1be39949c15836d4ddaf96f902bdd710594a8424fd2f9346b90665dcb1b353bb
Opcode Fuzzy Hash: 770c7217069deaf535aca921faf004fe4184be8004e6e6e6d4d102fb4435b2a9
Instruction Fuzzy Hash: BE218E755093C08FCB02DF20D994B15BF71FB46314F28C5EAD8498B6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.353897722.0000000000C4D000.00000040.00000001.sdmp, Offset: 00C4D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a6aa8af582cc9395ba93de792f946ae331512fa05d3b1ca49f3c75251244b0
Instruction ID: 79ceafafa246121fcf23d4e23c740f2441a0b9aaf8555ecc92c33be090b46331
Opcode Fuzzy Hash: 03a6aa8af582cc9395ba93de792f946ae331512fa05d3b1ca49f3c75251244b0
Instruction Fuzzy Hash: C1118B75904280DFCB11DF10D5C4B15BBA2FB84324F28C6ADD84A4B656C37AD95ACB61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D4E5F0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adab005a93e263b292e9758329a89c1c9ed795832a42c29865a07ef70cf61b33
Instruction ID: a18cd39afdcd9870710a1237a28b18d12a29c8006c02c5dd21983dd0d739253d
Opcode Fuzzy Hash: adab005a93e263b292e9758329a89c1c9ed795832a42c29865a07ef70cf61b33
Instruction Fuzzy Hash: BD12B5F1C937668BE310CF65E8885893F71B785329BD1CB09D261AEAD0D7B4116ACF48

Uniqueness

Uniqueness Score: -1.00%

Function 00D4C194, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fc068acb7c9605eb23cd58bb829dc48826dfd8d3534eeed7973ef7756c8fd7
Instruction ID: 4a7357b8592563b3586baef1f11c188f53f00d8571889c5378cb627800bfc608
Opcode Fuzzy Hash: a9fc068acb7c9605eb23cd58bb829dc48826dfd8d3534eeed7973ef7756c8fd7
Instruction Fuzzy Hash: 7BA17D32E10219CFCF15DFA5C8845DEBBB2FF85300B19856AE905FB261EB71A905CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D4E5E0, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.354067111.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19259ef079cb67b91672cf751fda258bdb6b9f2e257894f39e0dd185ee7e3ac5
Instruction ID: ca9af56181e8d0473887dccd3cf5176eea9de5b9112f1cc5c55b8ce1dfd0c499
Opcode Fuzzy Hash: 19259ef079cb67b91672cf751fda258bdb6b9f2e257894f39e0dd185ee7e3ac5
Instruction Fuzzy Hash: 2AC10BB1C927668BD710CF65E8881897F71BB85328FD1CB09D261AF6D0D7B4146ACF48

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qOthJCpJ8E.exe PID: 6916 Parent PID: 6764 qOthJCpJ8E.exeCOMMON

Executed Functions

Function 00C6F03F, Relevance: 2.3, APIs: 1, Instructions: 758libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C6F7C8

Memory Dump Source

Source File: 00000004.00000002.602831910.0000000000C60000.00000040.00000001.sdmp, Offset: 00C60000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 227cf204f986dd9463305f34e0a63e16a9721ca4595eec8b0427f2639f9595de
Instruction ID: 88627c5a18d8359fb8ea3467d1edd0d57aeeee4b3615c5c1ad5b90dd61fe18d7
Opcode Fuzzy Hash: 227cf204f986dd9463305f34e0a63e16a9721ca4595eec8b0427f2639f9595de
Instruction Fuzzy Hash: D6621770E047188FCB24EF78D89469DB7B2AF89304F1185A9D54AAB354EF309E85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C51FA8, Relevance: 1.7, APIs: 1, Instructions: 212libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C52039

Memory Dump Source

Source File: 00000004.00000002.602716955.0000000000C50000.00000040.00000001.sdmp, Offset: 00C50000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bdec5b88dbafbe250eeafc46bf69a35fdbd5383351f2b4f792730dce203c139e
Instruction ID: 6bc1e10e1d91ddf5566cce854daf95f5de1d4bc91c2bcc8caea5b819a43c0d22
Opcode Fuzzy Hash: bdec5b88dbafbe250eeafc46bf69a35fdbd5383351f2b4f792730dce203c139e
Instruction Fuzzy Hash: DA719D34A043048FDB14EBB5D8587AEB7F1AF85305F108828E816E7395DF399D89CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00F6691F, Relevance: 6.1, APIs: 4, Instructions: 136threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00F669A0
GetCurrentThread.KERNEL32 ref: 00F669DD
GetCurrentProcess.KERNEL32 ref: 00F66A1A
GetCurrentThreadId.KERNEL32 ref: 00F66A73

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c1678f85d4cb11c89f5b019bd09d94b71e132f434e0adb36d4e4c97dcf96cbb2
Instruction ID: d495b72a6d4437bfbf1b7fa3bc31664b20446bb544b86b2349bb0d385609aaca
Opcode Fuzzy Hash: c1678f85d4cb11c89f5b019bd09d94b71e132f434e0adb36d4e4c97dcf96cbb2
Instruction Fuzzy Hash: D25166B09002488FDB14CFAAD588BDEBFF4EF89314F24845EE458A7291D7756888CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00F66940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00F669A0
GetCurrentThread.KERNEL32 ref: 00F669DD
GetCurrentProcess.KERNEL32 ref: 00F66A1A
GetCurrentThreadId.KERNEL32 ref: 00F66A73

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 01fddce7a60cb7dee71e228c2468a8a410fb0cda2520194ebdd7344286edcb05
Instruction ID: 18fe8b22955943af598ac6175a2ab0499692268293deb60d21b877fa36baefa1
Opcode Fuzzy Hash: 01fddce7a60cb7dee71e228c2468a8a410fb0cda2520194ebdd7344286edcb05
Instruction Fuzzy Hash: 4D5131B0D002488FDB18CFAAD648BDEBBF4FF88314F24846AE419B7250D7756884CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00C60B18, Relevance: 1.9, APIs: 1, Instructions: 433libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C60ED8

Memory Dump Source

Source File: 00000004.00000002.602831910.0000000000C60000.00000040.00000001.sdmp, Offset: 00C60000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 54e1f5b119aff17c09e60a2ae6ee90720c6eb9735d889089e0f49bdfd38d185a
Instruction ID: 113e40c2b82fa918d3d6cdd447d30665e7c3b2d58ee6fa6c82c6efc01413b535
Opcode Fuzzy Hash: 54e1f5b119aff17c09e60a2ae6ee90720c6eb9735d889089e0f49bdfd38d185a
Instruction Fuzzy Hash: F8E12730B042059FCB24EBB4D8956AE7BF6AF85304F244969D406EB396EF34DD05C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F65084, Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F651A2

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3b489ef4da56ab6a13eeb765b21f4ebaaa96ed11f9839e445c302058a8fd590f
Instruction ID: 90bda4b5d5f297b10272a8a8a69b9f12cebafd356a7575423023caa0bce331ec
Opcode Fuzzy Hash: 3b489ef4da56ab6a13eeb765b21f4ebaaa96ed11f9839e445c302058a8fd590f
Instruction Fuzzy Hash: 8F51DFB1D103189FDF14CFAAD884ADEBBB5FF89714F24812AE818AB210D7759845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C60988, Relevance: 1.6, APIs: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 00C60A91

Memory Dump Source

Source File: 00000004.00000002.602831910.0000000000C60000.00000040.00000001.sdmp, Offset: 00C60000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 841ec1f88ecc0ad1f8b885553f067d63c46a0253921e8ca0aadd8235f5896258
Instruction ID: 3245634fc9c509ea693205b36f7a29999cb8aa08ad275bdb699e683c147cea59
Opcode Fuzzy Hash: 841ec1f88ecc0ad1f8b885553f067d63c46a0253921e8ca0aadd8235f5896258
Instruction Fuzzy Hash: 3A41F7B1E003599FCB10CFD9C884A9EBBF5FB48750F258029E818BB255D7749945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F65090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F651A2

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 60373a9adf41a90c1028733fb0d120a400ceb94d0a075c2ff417218cc39ae423
Instruction ID: 29d5be1f891e64f570c9e4c288a31e4631ae47e41542949b37838c033f0bc0ee
Opcode Fuzzy Hash: 60373a9adf41a90c1028733fb0d120a400ceb94d0a075c2ff417218cc39ae423
Instruction Fuzzy Hash: 8141CEB1D103189FDF14CF9AD884ADEBBB5FF89314F24812AE819AB210D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C606D0, Relevance: 1.6, APIs: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 00C607D4

Memory Dump Source

Source File: 00000004.00000002.602831910.0000000000C60000.00000040.00000001.sdmp, Offset: 00C60000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 3bfa952451705771e6be6a454d655658d2acb868ad1a2ce3b79f4fa6243e2764
Instruction ID: 6383f3e333386878095b2348c3c532f469a0b4155187bc85498b12d161a5f1b0
Opcode Fuzzy Hash: 3bfa952451705771e6be6a454d655658d2acb868ad1a2ce3b79f4fa6243e2764
Instruction Fuzzy Hash: 8D4125B1E013498FDB10CFA9C588A9EFBF5AF48314F28C16AE409AB341D7B59945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F6779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00F67F09

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 8951a3b3ef1420efbc274e1581d68ac6c6c507187b709cc45044274723da0d2f
Instruction ID: 0c77249767d23cb11c53913cf2c6b665ee4796968e7d8affbcb7b0cb708d592f
Opcode Fuzzy Hash: 8951a3b3ef1420efbc274e1581d68ac6c6c507187b709cc45044274723da0d2f
Instruction Fuzzy Hash: 5B4158B59003058FCB14DF99C488AAABBF5FF88328F24C459E419AB321D375A845DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F6C199, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00F6C222

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: c735e6146ff35ed424543c0b61ef97f05702c14b8103147518a9b20e9566e99a
Instruction ID: 70b7f55d7cca493835ae5ca29a643e96c0a6155f461d593a7f2c9dce2b421b1b
Opcode Fuzzy Hash: c735e6146ff35ed424543c0b61ef97f05702c14b8103147518a9b20e9566e99a
Instruction Fuzzy Hash: 4C31EF718043848FCB10EFA9E9083DA7FF4EB46714F18846AD488A7202D3795844DFE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F66B62, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F66BEF

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 853b8c0e6d50aec1327ac0db4b8f92bf3e79b87eb7f52b4c39fd0f60c89f02d4
Instruction ID: b8416ecfb9fe2b7545d498c41fc13a0c8ce5f3ad1e3d637f0814f6785557ee5f
Opcode Fuzzy Hash: 853b8c0e6d50aec1327ac0db4b8f92bf3e79b87eb7f52b4c39fd0f60c89f02d4
Instruction Fuzzy Hash: C621C0B59002489FDB10CFAAD584AEEBBF8FB48324F14841AE914A7210D379A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F66B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F66BEF

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0c5cd7dfa57baa765ed52e8ed3a99d5a5ed63203f3fce6d40343423dda2b6a3b
Instruction ID: e3cc421857067500785502583fa46dfbe9ef48b805b52548e47c9a8f50e80cb5
Opcode Fuzzy Hash: 0c5cd7dfa57baa765ed52e8ed3a99d5a5ed63203f3fce6d40343423dda2b6a3b
Instruction Fuzzy Hash: B721D3B5D00248DFDB10CFAAD984ADEBBF8FB48324F14841AE914A7310D375A954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F6C1A8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00F6C222

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 6f0e7170eeb8a55aa30d632a2ce4338ba05344eeffae66073cf1c061f55348c9
Instruction ID: 3a5295a19f2292df860e3da4fd6c73945b0b64e102e02e06864f23a684addaba
Opcode Fuzzy Hash: 6f0e7170eeb8a55aa30d632a2ce4338ba05344eeffae66073cf1c061f55348c9
Instruction Fuzzy Hash: 871189719003188FCB20EFEAD5087DEBBF4EB4A724F24842AC449A3201D779A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F640AA, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F64116

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 18daddb7e0a2de411aa6f90d12917c0b2c4c0fed64f1d4643d44a43e9af8955c
Instruction ID: 9cc5b1cbd84553673606e208dfc2d802e9579af5f8fca67978e45a131dbf4278
Opcode Fuzzy Hash: 18daddb7e0a2de411aa6f90d12917c0b2c4c0fed64f1d4643d44a43e9af8955c
Instruction Fuzzy Hash: C81102B5C002498FCB10DF9AD444ADEFBF4EF89324F14852AD419B7600D375A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F63300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F64116

Memory Dump Source

Source File: 00000004.00000002.606852969.0000000000F60000.00000040.00000001.sdmp, Offset: 00F60000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9e48a054cbd8763f5d85db99c0f4fcf53b57aa252b180a6798da2cf032dc57c9
Instruction ID: 93df735f7953795d34d5aa290d0051d9b5c672245d314de1ff97cc8bc76ad3e7
Opcode Fuzzy Hash: 9e48a054cbd8763f5d85db99c0f4fcf53b57aa252b180a6798da2cf032dc57c9
Instruction Fuzzy Hash: 511113B6C006498FCB10EF9AD444BDEFBF4EB89324F14842AD929B7600D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report qOthJCpJ8E

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre