Play interactive tour

Edit tour

Windows Analysis Report QUOTE 7254.bat

Overview

General Information

Sample Name:	QUOTE 7254.bat (renamed file extension from bat to exe)
Analysis ID:	502634
MD5:	4d0f6d1430135a6779417b51294af53c
SHA1:	a473af0c7fa93abf4ee9f780664eee49843ca008
SHA256:	810834cae1e8be03e2534968ea0a1132a6d2dd18d8fd3e366c3d9dca3fb05846
Tags:	AgentTeslabatexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

QUOTE 7254.exe (PID: 5028 cmdline: 'C:\Users\user\Desktop\QUOTE 7254.exe' MD5: 4D0F6D1430135A6779417B51294AF53C)

schtasks.exe (PID: 400 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OgXhLeamRasUa' /XML 'C:\Users\user\AppData\Local\Temp\tmpE381.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

QUOTE 7254.exe (PID: 7020 cmdline: C:\Users\user\Desktop\QUOTE 7254.exe MD5: 4D0F6D1430135A6779417B51294AF53C)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "anams@rapidmail.ec", "Password": "icui4cu2@@", "Host": "mail.rapidmail.ec"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.315370304.00000000034E9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.315370304.00000000034E9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.314916497.00000000025D9000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000006.00000002.560111037.0000000003034000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.315692620.00000000036D2000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.315692620.00000000036D2000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000006.00000002.558003785.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.558003785.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.314296675.00000000024E1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: QUOTE 7254.exe PID: 5028	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: QUOTE 7254.exe PID: 5028	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: QUOTE 7254.exe PID: 7020	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: QUOTE 7254.exe PID: 7020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.QUOTE 7254.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.QUOTE 7254.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.QUOTE 7254.exe.36e88d0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTE 7254.exe.36e88d0.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.QUOTE 7254.exe.25030f8.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.QUOTE 7254.exe.3786320.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTE 7254.exe.3786320.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.QUOTE 7254.exe.3786320.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTE 7254.exe.3786320.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 4 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.QUOTE 7254.exe.3786320.2.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "anams@rapidmail.ec", "Password": "icui4cu2@@", "Host": "mail.rapidmail.ec"}

Multi AV Scanner detection for submitted file

Show sources

Source: QUOTE 7254.exe	Virustotal: Detection: 13%			Perma Link
Source: QUOTE 7254.exe	ReversingLabs: Detection: 13%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\OgXhLeamRasUa.exe

ReversingLabs: Detection: 13%

Source: 6.2.QUOTE 7254.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: QUOTE 7254.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: QUOTE 7254.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: QUOTE 7254.exe, 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: QUOTE 7254.exe, 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: QUOTE 7254.exe, 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp	String found in binary or memory: http://RSNcbZ.com
Source: QUOTE 7254.exe, 00000000.00000003.294629031.000000000558B000.00000004.00000001.sdmp	String found in binary or memory: http://en.w
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: QUOTE 7254.exe, 00000000.00000002.314296675.00000000024E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: QUOTE 7254.exe, 00000000.00000002.314296675.00000000024E1000.00000004.00000001.sdmp	String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: QUOTE 7254.exe, 00000000.00000003.300887871.0000000005579000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: QUOTE 7254.exe, 00000000.00000002.316736581.0000000005570000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comepko
Source: QUOTE 7254.exe, 00000000.00000002.316736581.0000000005570000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comionm
Source: QUOTE 7254.exe, 00000000.00000002.316736581.0000000005570000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: QUOTE 7254.exe, 00000000.00000003.294745041.000000000558B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com-ug6
Source: QUOTE 7254.exe, 00000000.00000003.294745041.000000000558B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comW
Source: QUOTE 7254.exe, 00000000.00000003.294764684.000000000558B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comr
Source: QUOTE 7254.exe, 00000000.00000003.296500677.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.c)
Source: QUOTE 7254.exe, 00000000.00000003.296500677.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: QUOTE 7254.exe, 00000000.00000003.296709307.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: QUOTE 7254.exe, 00000000.00000003.296709307.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/tp
Source: QUOTE 7254.exe, 00000000.00000003.296500677.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnCY
Source: QUOTE 7254.exe, 00000000.00000003.296453440.00000000055AD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cns-e
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/5
Source: QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/:
Source: QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/C
Source: QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/t
Source: QUOTE 7254.exe, 00000000.00000003.294629031.000000000558B000.00000004.00000001.sdmp, QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: QUOTE 7254.exe, 00000000.00000003.294629031.000000000558B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comGxz
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: QUOTE 7254.exe, 00000000.00000003.295921750.0000000005576000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krF
Source: QUOTE 7254.exe, 00000000.00000003.295921750.0000000005576000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krtri
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: QUOTE 7254.exe, 00000000.00000003.295033022.000000000558B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comc
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: QUOTE 7254.exe, 00000000.00000002.315692620.00000000036D2000.00000004.00000001.sdmp, QUOTE 7254.exe, 00000006.00000002.558003785.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: QUOTE 7254.exe, 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 6.2.QUOTE 7254.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b041C5864u002d8BC5u002d4FD4u002d8275u002d9B3B73CB91FAu007d/FA9420DDu002d9003u002d4CC1u002d9A6Eu002dDA16936AF8BD.cs

Large array initialization: .cctor: array initializer size 11777

Source: QUOTE 7254.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Code function: 0_2_00ADD064	0_2_00ADD064
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Code function: 0_2_00ADF298	0_2_00ADF298
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Code function: 0_2_00ADF296	0_2_00ADF296
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Code function: 6_2_013446A0	6_2_013446A0
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Code function: 6_2_01344690	6_2_01344690

Source: QUOTE 7254.exe	Binary or memory string: OriginalFilename vs QUOTE 7254.exe
Source: QUOTE 7254.exe, 00000000.00000000.292258208.00000000000E2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSoapTi.exe6 vs QUOTE 7254.exe
Source: QUOTE 7254.exe, 00000000.00000002.315692620.00000000036D2000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dll< vs QUOTE 7254.exe
Source: QUOTE 7254.exe, 00000000.00000002.315692620.00000000036D2000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamejOUkZdFMCThYhhcCysTX.exe4 vs QUOTE 7254.exe
Source: QUOTE 7254.exe	Binary or memory string: OriginalFilename vs QUOTE 7254.exe
Source: QUOTE 7254.exe, 00000006.00000002.559218723.00000000011DA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs QUOTE 7254.exe
Source: QUOTE 7254.exe, 00000006.00000000.311728017.0000000000A42000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSoapTi.exe6 vs QUOTE 7254.exe
Source: QUOTE 7254.exe, 00000006.00000002.558560034.0000000000EF8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs QUOTE 7254.exe
Source: QUOTE 7254.exe, 00000006.00000002.558104120.0000000000438000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamejOUkZdFMCThYhhcCysTX.exe4 vs QUOTE 7254.exe
Source: QUOTE 7254.exe	Binary or memory string: OriginalFilenameSoapTi.exe6 vs QUOTE 7254.exe

Source: QUOTE 7254.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: OgXhLeamRasUa.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: QUOTE 7254.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: OgXhLeamRasUa.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: QUOTE 7254.exe	Virustotal: Detection: 13%
Source: QUOTE 7254.exe	ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\QUOTE 7254.exe

File read: C:\Users\user\Desktop\QUOTE 7254.exe

Jump to behavior

Source: QUOTE 7254.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\QUOTE 7254.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QUOTE 7254.exe 'C:\Users\user\Desktop\QUOTE 7254.exe'
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OgXhLeamRasUa' /XML 'C:\Users\user\AppData\Local\Temp\tmpE381.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process created: C:\Users\user\Desktop\QUOTE 7254.exe C:\Users\user\Desktop\QUOTE 7254.exe
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OgXhLeamRasUa' /XML 'C:\Users\user\AppData\Local\Temp\tmpE381.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process created: C:\Users\user\Desktop\QUOTE 7254.exe C:\Users\user\Desktop\QUOTE 7254.exe	Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\QUOTE 7254.exe

File created: C:\Users\user\AppData\Local\Gottschalks

Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE381.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/4@0/0

Source: C:\Users\user\Desktop\QUOTE 7254.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Mutant created: \Sessions\1\BaseNamedObjects\hnmBLPJLNqlb
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6028:120:WilError_01

Source: 6.2.QUOTE 7254.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.2.QUOTE 7254.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\QUOTE 7254.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: QUOTE 7254.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTE 7254.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: QUOTE 7254.exe, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: OgXhLeamRasUa.exe.0.dr, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.QUOTE 7254.exe.e0000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.QUOTE 7254.exe.e0000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 6.0.QUOTE 7254.exe.a40000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Code function: 0_2_00AD203B push ebx; retf	0_2_00AD207A
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Code function: 0_2_07560298 pushfd ; ret	0_2_07560299
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Code function: 0_2_07564F4F push FFFFFF8Bh; iretd	0_2_07564F5F

Source: initial sample	Static PE information: section name: .text entropy: 7.85186272039
Source: initial sample	Static PE information: section name: .text entropy: 7.85186272039

Source: C:\Users\user\Desktop\QUOTE 7254.exe

File created: C:\Users\user\AppData\Roaming\OgXhLeamRasUa.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\QUOTE 7254.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OgXhLeamRasUa' /XML 'C:\Users\user\AppData\Local\Temp\tmpE381.tmp'

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 0.2.QUOTE 7254.exe.25030f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.314916497.00000000025D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.314296675.00000000024E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTE 7254.exe PID: 5028, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: QUOTE 7254.exe, 00000000.00000002.314916497.00000000025D9000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: QUOTE 7254.exe, 00000000.00000002.314916497.00000000025D9000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\QUOTE 7254.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\QUOTE 7254.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\QUOTE 7254.exe TID: 2268	Thread sleep time: -43629s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe TID: 4840	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe TID: 7080	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe TID: 7076	Thread sleep count: 602 > 30	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe TID: 7076	Thread sleep count: 9236 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Window / User API: threadDelayed 602			Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Window / User API: threadDelayed 9236			Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\QUOTE 7254.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Thread delayed: delay time: 43629	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: QUOTE 7254.exe, 00000000.00000002.314916497.00000000025D9000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: QUOTE 7254.exe, 00000000.00000002.314916497.00000000025D9000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: QUOTE 7254.exe, 00000000.00000002.314916497.00000000025D9000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: QUOTE 7254.exe, 00000000.00000002.314916497.00000000025D9000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OgXhLeamRasUa' /XML 'C:\Users\user\AppData\Local\Temp\tmpE381.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Process created: C:\Users\user\Desktop\QUOTE 7254.exe C:\Users\user\Desktop\QUOTE 7254.exe			Jump to behavior

Source: QUOTE 7254.exe, 00000006.00000002.559662617.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: QUOTE 7254.exe, 00000006.00000002.559662617.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: QUOTE 7254.exe, 00000006.00000002.559662617.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: QUOTE 7254.exe, 00000006.00000002.559662617.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Users\user\Desktop\QUOTE 7254.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Users\user\Desktop\QUOTE 7254.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QUOTE 7254.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 6.2.QUOTE 7254.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTE 7254.exe.36e88d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTE 7254.exe.3786320.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTE 7254.exe.3786320.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.315370304.00000000034E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.315692620.00000000036D2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.558003785.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.560111037.0000000003034000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTE 7254.exe PID: 5028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTE 7254.exe PID: 7020, type: MEMORYSTR

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\QUOTE 7254.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\QUOTE 7254.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\QUOTE 7254.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTE 7254.exe PID: 7020, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 6.2.QUOTE 7254.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTE 7254.exe.36e88d0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTE 7254.exe.3786320.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTE 7254.exe.3786320.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.315370304.00000000034E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.315692620.00000000036D2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.558003785.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.560111037.0000000003034000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTE 7254.exe PID: 5028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTE 7254.exe PID: 7020, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection12	Masquerading1	OS Credential Dumping1	Security Software Discovery311	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Virtualization/Sandbox Evasion131	SMB/Windows Admin Shares	Data from Local System1	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	System Information Discovery114	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
QUOTE 7254.exe	14%	Virustotal		Browse
QUOTE 7254.exe	14%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\OgXhLeamRasUa.exe	14%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
6.2.QUOTE 7254.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.comepko	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.collada.org/2005/11/COLLADASchema9Done	0%	URL Reputation	safe
http://www.founder.com.cn/cn/tp	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/:	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/5	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.comr	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.krF	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://www.fonts.com-ug6	0%	Avira URL Cloud	safe
http://www.sandoll.co.krtri	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://RSNcbZ.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnCY	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/C	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/t	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fonts.comW	0%	Avira URL Cloud	safe
http://en.w	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comionm	0%	Avira URL Cloud	safe
http://www.founder.c)	0%	Avira URL Cloud	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.sajatypeworks.comGxz	0%	Avira URL Cloud	safe
http://www.tiro.comc	0%	URL Reputation	safe
http://www.founder.com.cn/cns-e	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	QUOTE 7254.exe, 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false		high
http://www.tiro.com	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	QUOTE 7254.exe, 00000000.00000003.300887871.0000000005579000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comepko	QUOTE 7254.exe, 00000000.00000002.316736581.0000000005570000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.collada.org/2005/11/COLLADASchema9Done	QUOTE 7254.exe, 00000000.00000002.314296675.00000000024E1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/tp	QUOTE 7254.exe, 00000000.00000003.296709307.0000000005574000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	QUOTE 7254.exe, 00000000.00000003.294629031.000000000558B000.00000004.00000001.sdmp, QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/:	QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/5	QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false		high
http://www.fonts.comr	QUOTE 7254.exe, 00000000.00000003.294764684.000000000558B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.kr	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.krF	QUOTE 7254.exe, 00000000.00000003.295921750.0000000005576000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	QUOTE 7254.exe, 00000000.00000002.314296675.00000000024E1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	QUOTE 7254.exe, 00000000.00000002.315692620.00000000036D2000.00000004.00000001.sdmp, QUOTE 7254.exe, 00000006.00000002.558003785.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com-ug6	QUOTE 7254.exe, 00000000.00000003.294745041.000000000558B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.krtri	QUOTE 7254.exe, 00000000.00000003.295921750.0000000005576000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNS	QUOTE 7254.exe, 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	QUOTE 7254.exe, 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://RSNcbZ.com	QUOTE 7254.exe, 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnCY	QUOTE 7254.exe, 00000000.00000003.296500677.0000000005574000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/C	QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/t	QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comW	QUOTE 7254.exe, 00000000.00000003.294745041.000000000558B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://en.w	QUOTE 7254.exe, 00000000.00000003.294629031.000000000558B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	QUOTE 7254.exe, 00000000.00000003.296709307.0000000005574000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn	QUOTE 7254.exe, 00000000.00000003.296500677.0000000005574000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comionm	QUOTE 7254.exe, 00000000.00000002.316736581.0000000005570000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.c)	QUOTE 7254.exe, 00000000.00000003.296500677.0000000005574000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.comm	QUOTE 7254.exe, 00000000.00000002.316736581.0000000005570000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	QUOTE 7254.exe, 00000000.00000003.298086089.0000000005574000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	QUOTE 7254.exe, 00000000.00000002.316952601.0000000006782000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.comGxz	QUOTE 7254.exe, 00000000.00000003.294629031.000000000558B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.comc	QUOTE 7254.exe, 00000000.00000003.295033022.000000000558B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cns-e	QUOTE 7254.exe, 00000000.00000003.296453440.00000000055AD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502634
Start date:	14.10.2021
Start time:	07:47:09
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	QUOTE 7254.bat (renamed file extension from bat to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/4@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.5% (good quality ratio 0.3%) Quality average: 40.5% Quality standard deviation: 37%
HCA Information:	Successful, ratio: 100% Number of executed functions: 18 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.50.102.62, 20.54.110.249, 40.112.88.60, 52.251.79.25, 8.248.137.254, 67.27.157.126, 8.248.143.254, 8.248.117.254, 8.248.135.254, 20.199.120.85, 2.20.178.33, 2.20.178.24, 20.199.120.182, 20.82.209.183 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, client.wns.windows.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, wu-shim.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:48:13	API Interceptor	787x Sleep call for process: QUOTE 7254.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTE 7254.exe.log Download File
Process:	C:\Users\user\Desktop\QUOTE 7254.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1308
Entropy (8bit):	5.348115897127242
Encrypted:	false
SSDEEP:	24:MLUE4KJXE4qpE4Ks2E1qE4qpAE4Kzr7RKDE4KhK3VZ9pKhPKIE4oKFKHKorE4x88:MIHKtH2HKXE1qHmAHKzvRYHKhQnoPtH2
MD5:	832D6A22CE7798D72609B9C21B4AF152
SHA1:	B086DE927BFEE6039F5555CE53C397D1E59B4CA4
SHA-256:	9E5EE72EF293C66406AF155572BF3B0CF9DA09CC1F60ED6524AAFD65553CE551
SHA-512:	A1A70F76B98C2478830AE737B4F12507D859365F046C5A415E1EBE3D87FFD2B64663A31E1E5142F7C3A7FE9A6A9CB8C143C2E16E94C3DD6041D1CCABEDDD2C21
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows

C:\Users\user\AppData\Local\Temp\tmpE381.tmp Download File
Process:	C:\Users\user\Desktop\QUOTE 7254.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1646
Entropy (8bit):	5.187281476403803
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBMtn:cbh47TlNQ//rydbz9I3YODOLNdq3g
MD5:	1385551B6E7BA262A26E79D9DC4BCBF8
SHA1:	462D9710631E60FEC0309EF59E32098B8C4E0D08
SHA-256:	A452EE129B69E2679617EE22235B297CB8987548A21C8C314F2A0B723C6E0CAB
SHA-512:	11ED65279FC9750A912DE4B67543A15DD4A9397F100FE78AE0579D502C6D5932E0F70543FAAF5C9FD6E995AC81200DC2DA5FE49631F22F2D5989CBD37D3553CA
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\OgXhLeamRasUa.exe Download File
Process:	C:\Users\user\Desktop\QUOTE 7254.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	591872
Entropy (8bit):	7.623758179121773
Encrypted:	false
SSDEEP:	12288:jNUPCwBZCxvEa0mQcHquNArHutWMYlHqQAYYXmQF5epOEtDSB/A:6ZgvEa0BequNArOtYEVhXm9pj2B/
MD5:	4D0F6D1430135A6779417B51294AF53C
SHA1:	A473AF0C7FA93ABF4EE9F780664EEE49843CA008
SHA-256:	810834CAE1E8BE03E2534968EA0A1132A6D2DD18D8FD3E366C3D9DCA3FB05846
SHA-512:	67F89029D4185A8335303D43EEE87AAE9CD5E2C7FAF6F7F67B32116B5D27DAAE9E71BD48132C066B3B7A57D63430334CE073E818FCEBE0E50C0114A0196CCBE6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....fa..............0..v............... ........@.. .......................`............@.................................H...O.......\|....................@....................................................... ............... ..H............text....t... ...v.................. ..`.rsrc...\|............x..............@..@.reloc.......@......................@..B................\|.......H.......Lb...O......Y...X................................................0..V.........}.......s....}......}......}.....(.......(......{....r...po......{....r...po.....*...0.............(....&.{.........,....8....sA...%.{.....\|....(....Z.{.....\|....(....Z . &.s....} ...%.}......{ ...(.........(....o........+c...+C.....X.].......,+..(.......{....Z...{....Z.{.....{....o ........X.....\|....(..........-....X.....\|....(..........-......,...o!.....sB........\|....(.....\|....(....s"

C:\Users\user\AppData\Roaming\OgXhLeamRasUa.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\QUOTE 7254.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.623758179121773
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	QUOTE 7254.exe
File size:	591872
MD5:	4d0f6d1430135a6779417b51294af53c
SHA1:	a473af0c7fa93abf4ee9f780664eee49843ca008
SHA256:	810834cae1e8be03e2534968ea0a1132a6d2dd18d8fd3e366c3d9dca3fb05846
SHA512:	67f89029d4185a8335303d43eee87aae9cd5e2c7faf6f7f67b32116b5d27daae9e71bd48132c066b3b7a57d63430334ce073e818fcebe0e50c0114a0196ccbe6
SSDEEP:	12288:jNUPCwBZCxvEa0mQcHquNArHutWMYlHqQAYYXmQF5epOEtDSB/A:6ZgvEa0BequNArOtYEVhXm9pj2B/
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....fa..............0..v............... ........@.. .......................`............@................................

File Icon


Icon Hash:	c4b28ed696aa92c0

Static PE Info

General
Entrypoint:	0x47949a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61668D0A [Wed Oct 13 07:38:50 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x79448	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7a000	0x18c7c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x94000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x774a0	0x77600	False	0.909890379581	data	7.85186272039	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x7a000	0x18c7c	0x18e00	False	0.195253611809	data	5.0688560408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x94000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x7a180	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x7a5f8	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0x7b6b0	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x7dc68	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON	0x81ea0	0x10828	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0x926d8	0x4c	data
RT_VERSION	0x92734	0x348	data
RT_MANIFEST	0x92a8c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Gottschalks 2011
Assembly Version	1.0.0.0
InternalName	SoapTi.exe
FileVersion	1.0.0.0
CompanyName	Gottschalks
LegalTrademarks
Comments
ProductName	MapEditor1
ProductVersion	1.0.0.0
FileDescription	MapEditor1
OriginalFilename	SoapTi.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: QUOTE 7254.exe PID: 5028 Parent PID: 3424

General

Start time:	07:48:07
Start date:	14/10/2021
Path:	C:\Users\user\Desktop\QUOTE 7254.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\QUOTE 7254.exe'
Imagebase:	0xe0000
File size:	591872 bytes
MD5 hash:	4D0F6D1430135A6779417B51294AF53C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.315370304.00000000034E9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.315370304.00000000034E9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.314916497.00000000025D9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.315692620.00000000036D2000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.315692620.00000000036D2000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.314296675.00000000024E1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 400 Parent PID: 5028

General

Start time:	07:48:15
Start date:	14/10/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OgXhLeamRasUa' /XML 'C:\Users\user\AppData\Local\Temp\tmpE381.tmp'
Imagebase:	0x100000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6028 Parent PID: 400

General

Start time:	07:48:16
Start date:	14/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: QUOTE 7254.exe PID: 7020 Parent PID: 5028

General

Start time:	07:48:16
Start date:	14/10/2021
Path:	C:\Users\user\Desktop\QUOTE 7254.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\QUOTE 7254.exe
Imagebase:	0xa40000
File size:	591872 bytes
MD5 hash:	4D0F6D1430135A6779417B51294AF53C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.560111037.0000000003034000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.558003785.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000006.00000002.558003785.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.559986480.0000000002F81000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: QUOTE 7254.exe PID: 5028 Parent PID: 3424 QUOTE 7254.exeCOMMON

Executed Functions

Function 00ADA2D0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ADA516

Strings

@Ot, xrefs: 00ADA473
@Ot, xrefs: 00ADA44E

Memory Dump Source

Source File: 00000000.00000002.313784947.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: HandleModule
String ID: @Ot$@Ot
API String ID: 4139908857-1417152503
Opcode ID: 3afa9455fa9f39fd1608e68386f1f23615e3452ea994f25a3b4709fbfa4d7de0
Instruction ID: ecf2376e5e3cd87aa4c8b0184d1d7114f935cd24c5b661ae592e27c0604ff7bd
Opcode Fuzzy Hash: 3afa9455fa9f39fd1608e68386f1f23615e3452ea994f25a3b4709fbfa4d7de0
Instruction Fuzzy Hash: C4711470A00B058FD724DF6AD14579ABBF6BF88314F00892ED48ADBB50DB74E9458B92

Uniqueness

Uniqueness Score: -1.00%

Function 00ADC7F0, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00ADC7BE,?,?,?,?,?), ref: 00ADC87F

Memory Dump Source

Source File: 00000000.00000002.313784947.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ba85c323fae7f2ce96c0a569b55856d41c5d83975acdd5dccec4df2af9912bab
Instruction ID: 93383148dfb6b63b1565e65d4768ef5b17dda90c3c4f2631055707929eeb6e88
Opcode Fuzzy Hash: ba85c323fae7f2ce96c0a569b55856d41c5d83975acdd5dccec4df2af9912bab
Instruction Fuzzy Hash: DA2116B5D01209DFDB10CFA9D484ADEBBF8FB48320F14841AE815A3710D7789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADAFFC, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00ADC7BE,?,?,?,?,?), ref: 00ADC87F

Memory Dump Source

Source File: 00000000.00000002.313784947.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0f8b756318ee60d02d3e457bc9319f4e1e3615cff17a62e080b9657af2a46948
Instruction ID: 5e0050e77b0cf783197bc46523f6701ce304810603f55854ebd847bbba8c22f0
Opcode Fuzzy Hash: 0f8b756318ee60d02d3e457bc9319f4e1e3615cff17a62e080b9657af2a46948
Instruction Fuzzy Hash: 7C21E5B5900209EFDB10CF99D584ADEBBF8EB48324F14841AE915A7310D774A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9DA0, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00ADA591,00000800,00000000,00000000), ref: 00ADA7A2

Memory Dump Source

Source File: 00000000.00000002.313784947.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fdc77930b0003f02c85add7341c901a31cd7ecf1df7fd2a09d342016a021264e
Instruction ID: 7526ee78bf212f8e5f1094b7ac9f723db03bfffc6a86fc40d4f61fe64d76c224
Opcode Fuzzy Hash: fdc77930b0003f02c85add7341c901a31cd7ecf1df7fd2a09d342016a021264e
Instruction Fuzzy Hash: 5D11E7B69003099FDB10CF9AD448ADEFBF4EB98314F14842ED416A7700C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA731, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00ADA591,00000800,00000000,00000000), ref: 00ADA7A2

Memory Dump Source

Source File: 00000000.00000002.313784947.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ddc0d2f30cc7f746ba8396086d7ae7d36f0df17d7a9bcc30069f479be001067c
Instruction ID: 1b0ac3fc922b8e76681fc606c8c6f774dc60898288269bd5426c7c35379b6ea7
Opcode Fuzzy Hash: ddc0d2f30cc7f746ba8396086d7ae7d36f0df17d7a9bcc30069f479be001067c
Instruction Fuzzy Hash: E811E2B69002498FDB14CFAAD584ADEFBF4AF58324F14852ED81AA7700C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07562E18, Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07562E7D

Memory Dump Source

Source File: 00000000.00000002.318320846.0000000007560000.00000040.00000001.sdmp, Offset: 07560000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f1b6992186fcfebaed8784e5e4a1eb783d2992e9d5c29545533e15a66e35af4a
Instruction ID: 4a5dbf52b09f4a81b3071ff5b2fd54b99020498f812a77f58f80c14b10af11de
Opcode Fuzzy Hash: f1b6992186fcfebaed8784e5e4a1eb783d2992e9d5c29545533e15a66e35af4a
Instruction Fuzzy Hash: A41106B58003099FDB10CF99D489BDEBFF4FB48320F20851AD418A7600C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA4B0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ADA516

Memory Dump Source

Source File: 00000000.00000002.313784947.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5a9e7a38345b4f9ba8ed82ade4a21efce756101087969a8a74a7cf2a28421f91
Instruction ID: 38ce4b56ae754af77aa95230a46b0f7265f8f6ee222c87cdb8748e60f15dda67
Opcode Fuzzy Hash: 5a9e7a38345b4f9ba8ed82ade4a21efce756101087969a8a74a7cf2a28421f91
Instruction Fuzzy Hash: 4711DFB5C006498FDB20CF9AD448ADEFBF4AB88324F14852AD42AA7700D374A545CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 07562E20, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07562E7D

Memory Dump Source

Source File: 00000000.00000002.318320846.0000000007560000.00000040.00000001.sdmp, Offset: 07560000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e42c35cbe2cc31b78357488c70de344bc769adafc0d0e1389783c76e98b8ac40
Instruction ID: b546149bd5960fca195a1ab9b18d07e9954bb4ee8ee24ff8bbb7ac6b0c2a907e
Opcode Fuzzy Hash: e42c35cbe2cc31b78357488c70de344bc769adafc0d0e1389783c76e98b8ac40
Instruction Fuzzy Hash: 1F11E5B5800349DFDB10CF9AD588BDEBBF8FB48324F14841AD919A7600D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00ADF298, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313784947.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 188b3b09ce536a2a92623d4f143568d5108c4b037067e756dbea340d2b356f7a
Instruction ID: 0f82ee50938ded5ab5389fc3d42df27495f30b9a9c11beb4701aeddb6270f3b1
Opcode Fuzzy Hash: 188b3b09ce536a2a92623d4f143568d5108c4b037067e756dbea340d2b356f7a
Instruction Fuzzy Hash: 351239F1C917468BD711CF66E8E81893BB8B745328FD04B0AD2611FAD9D3B8146ACF64

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD064, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313784947.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 002407708952e910fba740b4792fa88cf42060fb8b8bb4f6a7211f07c3746e4f
Instruction ID: 32c54d73b59eb38c2fa7896e7503b86cb09dd80cc3dda5b420126485ab348c37
Opcode Fuzzy Hash: 002407708952e910fba740b4792fa88cf42060fb8b8bb4f6a7211f07c3746e4f
Instruction Fuzzy Hash: A5A15C36E0021A8FCF15DFB5C9845DEBBB2FF85300B15856AE906BB321EB31A955CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00ADF296, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.313784947.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4d0ac9c1f5372278e89cf6f1ea33c150ecf5aea286219f18f654d917d083b8
Instruction ID: f36bfa7cff70c26d4ac637ab7ce8b697b169859614e0629df4e69f96de8e7bf7
Opcode Fuzzy Hash: 9b4d0ac9c1f5372278e89cf6f1ea33c150ecf5aea286219f18f654d917d083b8
Instruction Fuzzy Hash: A1C180F1C917458BD701DF66E8E81893BB9BB85328FD04B0AD2212F6D8D7B4146ACF64

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: QUOTE 7254.exe PID: 7020 Parent PID: 5028 QUOTE 7254.exeCOMMON

Executed Functions

Function 01346903, Relevance: 6.1, APIs: 4, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 013469A0
GetCurrentThread.KERNEL32 ref: 013469DD
GetCurrentProcess.KERNEL32 ref: 01346A1A
GetCurrentThreadId.KERNEL32 ref: 01346A73

Memory Dump Source

Source File: 00000006.00000002.559519322.0000000001340000.00000040.00000001.sdmp, Offset: 01340000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 299997650c310074d2dd60d9b86865d284eabb1c22c473efad32a6ce0015628f
Instruction ID: 51932bf466cc2b2a0bbc14989e7132a4ec21e5c476d9a3219b6aef684d3018fe
Opcode Fuzzy Hash: 299997650c310074d2dd60d9b86865d284eabb1c22c473efad32a6ce0015628f
Instruction Fuzzy Hash: F351BBB09047858FDB11CFA9D958BDEBFF0EF4A308F24889AD044AB351C7346888CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01346940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 013469A0
GetCurrentThread.KERNEL32 ref: 013469DD
GetCurrentProcess.KERNEL32 ref: 01346A1A
GetCurrentThreadId.KERNEL32 ref: 01346A73

Memory Dump Source

Source File: 00000006.00000002.559519322.0000000001340000.00000040.00000001.sdmp, Offset: 01340000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7fa1e8f25fe10b2426cdbf8f7471189eb5739027af74ca7f50b7504a8a6de75c
Instruction ID: 59b30e29d44178e940f7cbd3a8a7414d49b2ee64108ddeffeeda904cf20b2fbc
Opcode Fuzzy Hash: 7fa1e8f25fe10b2426cdbf8f7471189eb5739027af74ca7f50b7504a8a6de75c
Instruction Fuzzy Hash: D65145B49006498FEB14CFAAC648BDEBBF4EF89318F208459E459A7350D774A884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01345084, Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 013451A2

Memory Dump Source

Source File: 00000006.00000002.559519322.0000000001340000.00000040.00000001.sdmp, Offset: 01340000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 94f6a4fe33781730f21d68e500afb9aea4a027452354adaa83b052279edbc545
Instruction ID: 107c15f94b77c93e2ec7c8be7eb5f741907c57ca8195e67ea932ba812d10ca67
Opcode Fuzzy Hash: 94f6a4fe33781730f21d68e500afb9aea4a027452354adaa83b052279edbc545
Instruction Fuzzy Hash: 3951B0B1D103199FDF14CF99C884ADEBBF5BF48314F24852AE819AB210D775A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01345090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 013451A2

Memory Dump Source

Source File: 00000006.00000002.559519322.0000000001340000.00000040.00000001.sdmp, Offset: 01340000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d1f0b0ad39d26849f58642842b66b31bcc0cd9618d984d23c312883a6f8493d4
Instruction ID: ecaac779bdb7f546963eb4e86f727b1f0c3ea44bafb52281771d0a7dbad55130
Opcode Fuzzy Hash: d1f0b0ad39d26849f58642842b66b31bcc0cd9618d984d23c312883a6f8493d4
Instruction Fuzzy Hash: F34190B1D103099FDF14CF9AC884ADEBBF5BF48314F64852AE819AB210D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01347780, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01347F01

Memory Dump Source

Source File: 00000006.00000002.559519322.0000000001340000.00000040.00000001.sdmp, Offset: 01340000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 990f65ae7571db7c444fb9f0553ce3a4cb0eeb71937bdb35a11d5ad682a3840f
Instruction ID: 90274d2c961aebe1f54b3a939a1d46477730cbdbf7b010b2c95b843e6aefd02b
Opcode Fuzzy Hash: 990f65ae7571db7c444fb9f0553ce3a4cb0eeb71937bdb35a11d5ad682a3840f
Instruction Fuzzy Hash: 80411DB5900305CFDB14CF99C488A9ABBF5FF88318F24C559E519A7321D774A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01346B61, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01346BEF

Memory Dump Source

Source File: 00000006.00000002.559519322.0000000001340000.00000040.00000001.sdmp, Offset: 01340000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 68ac3344d742e81be936565a8501fdf529f351fcede46a848aaa61f3257385a0
Instruction ID: af5bb850b136ad303321257aa1538c6c49ef85f1a36d686f4523007b43677fd1
Opcode Fuzzy Hash: 68ac3344d742e81be936565a8501fdf529f351fcede46a848aaa61f3257385a0
Instruction Fuzzy Hash: D721E4B59002489FDB10CFA9D584AEEBFF4EB49324F14842AE914A3310D378A954CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01346B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01346BEF

Memory Dump Source

Source File: 00000006.00000002.559519322.0000000001340000.00000040.00000001.sdmp, Offset: 01340000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4242cb43c4bb6210c79fb066ea2b95e1bab9104662aadd1711fb76e2b5e74bc3
Instruction ID: 685a015c0ea57fa8ff6646a1874cef8505564946d6a826943d85f85995ecd629
Opcode Fuzzy Hash: 4242cb43c4bb6210c79fb066ea2b95e1bab9104662aadd1711fb76e2b5e74bc3
Instruction Fuzzy Hash: 5C21D3B5D00248DFDB10CFAAD984ADEBBF8FB49324F14841AE914A3310D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0134C198, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0134C212

Memory Dump Source

Source File: 00000006.00000002.559519322.0000000001340000.00000040.00000001.sdmp, Offset: 01340000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 1de50a25f4cbf4cb47b493d1c0761a4610f9d0f1ddc4621cd1189a5f47d75bb4
Instruction ID: f2a8ae70b46b00deb312ff2c8681a504ba7c8ef5c6eb203beaa720b498a0c8da
Opcode Fuzzy Hash: 1de50a25f4cbf4cb47b493d1c0761a4610f9d0f1ddc4621cd1189a5f47d75bb4
Instruction Fuzzy Hash: B2117C71D4230A8FDB10DFA9D54879EBBF4EB49318F24882AD409A7700C779A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013432D8, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01344116

Memory Dump Source

Source File: 00000006.00000002.559519322.0000000001340000.00000040.00000001.sdmp, Offset: 01340000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 031171c10b1e6863c13cf317ae877d42000cbb10665c60993882662fc641efcf
Instruction ID: adb7723a0e905ffa61df2e42ae42d12cce4ad10a6ab21e10e98fea8a0ca5cce1
Opcode Fuzzy Hash: 031171c10b1e6863c13cf317ae877d42000cbb10665c60993882662fc641efcf
Instruction Fuzzy Hash: 451102B6D006498FDB20DF9AC444BDEFBF4EB49328F14842AD929B7600D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013440AB, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01344116

Memory Dump Source

Source File: 00000006.00000002.559519322.0000000001340000.00000040.00000001.sdmp, Offset: 01340000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ceb11e87be19a34854fa35bf155795846180377e8bd8df9cfaaba79c1ea491f0
Instruction ID: 4e0c5defbb4ad5f283d9ba231c3b325a7e1462c3e17f737b4df90f5c6e4f388b
Opcode Fuzzy Hash: ceb11e87be19a34854fa35bf155795846180377e8bd8df9cfaaba79c1ea491f0
Instruction Fuzzy Hash: AC11F3B59006498BDB10CF9AC448BDEFBF4EB49314F15842AD429B7600D379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report QUOTE 7254.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: QUOTE 7254.exe PID: 5028 Parent PID: 3424