Windows Analysis Report TGFTR.vbs

Overview

General Information

Sample Name: TGFTR.vbs
Analysis ID: 546894
MD5: 49d19f0ce5da944d1423d3f189b22103
SHA1: 305fbc7a46a028c4354f13a417ba46f67464ebab
SHA256: ac0517947c0be7baad44fb8f054215c00ada03bb61772bab9eb52e48a9c3a097
Tags: AgentTeslavbs
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Benign windows process drops PE files
Yara detected AgentTesla
VBScript performs obfuscated calls to suspicious functions
Yara detected AntiVM3
Multi AV Scanner detection for dropped file
Installs a global keyboard hook
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Potential malicious VBS script found (has network functionality)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Machine Learning detection for dropped file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Creates a window with clipboard capturing capabilities
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: TGFTR.vbs ReversingLabs: Detection: 39%
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\anyname.exe ReversingLabs: Detection: 32%
Source: C:\Users\user\AppData\Local\Temp\tmpG259.tmp (copy) ReversingLabs: Detection: 32%
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe ReversingLabs: Detection: 32%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 6.0.anyname.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 18.0.jNnIJrO.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 14.0.jNnIJrO.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 14.2.jNnIJrO.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 14.0.jNnIJrO.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 6.2.anyname.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 6.0.anyname.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 14.0.jNnIJrO.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 18.0.jNnIJrO.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 18.0.jNnIJrO.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 18.0.jNnIJrO.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 18.2.jNnIJrO.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 6.0.anyname.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 18.0.jNnIJrO.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 14.0.jNnIJrO.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 14.0.jNnIJrO.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 6.0.anyname.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 6.0.anyname.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Code function: 4x nop then jmp 06F99093h 10_2_06F98328

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49799 -> 162.241.148.206:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49800 -> 162.241.148.206:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49803 -> 162.241.148.206:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49804 -> 162.241.148.206:587
Potential malicious VBS script found (has network functionality)
Source: Initial file: sea.SavetoFile maasr & "\anyname.exe",2
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49799 -> 162.241.148.206:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.3:49799 -> 162.241.148.206:587
Source: anyname.exe, 00000006.00000002.823366416.0000000002DD1000.00000004.00000001.sdmp, jNnIJrO.exe, 0000000E.00000002.439216232.0000000002FE1000.00000004.00000001.sdmp, jNnIJrO.exe, 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: jNnIJrO.exe, 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: jNnIJrO.exe, 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp String found in binary or memory: http://PGwAqe.com
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: anyname.exe, 00000006.00000002.825426440.0000000003138000.00000004.00000001.sdmp, anyname.exe, 00000006.00000002.825518834.000000000315A000.00000004.00000001.sdmp, jNnIJrO.exe, 00000012.00000002.826045034.0000000003461000.00000004.00000001.sdmp, jNnIJrO.exe, 00000012.00000002.825746785.000000000343E000.00000004.00000001.sdmp String found in binary or memory: http://mail.gnvmetalica.pe
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.303350130.0000000005389000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: anyname.exe, 00000001.00000003.304640191.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304726542.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html0
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: anyname.exe, 00000001.00000003.306557310.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306216816.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306488948.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306339731.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306416301.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306158695.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306247274.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306384385.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306447674.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306522725.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306584518.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306611590.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306185319.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306281192.0000000005384000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: anyname.exe, 00000001.00000003.307705902.0000000005373000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307218412.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307110201.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307047335.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307170119.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307135343.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307270002.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307012712.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307071537.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307193624.0000000005385000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: anyname.exe, 00000001.00000003.307110201.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307047335.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307012712.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307071537.0000000005385000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: anyname.exe, 00000001.00000003.307110201.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307047335.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307012712.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307071537.0000000005385000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmle
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: anyname.exe, 00000001.00000003.306522725.0000000005384000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html.
Source: anyname.exe, 00000001.00000003.306522725.0000000005384000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlh)7
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: anyname.exe, 00000001.00000003.306557310.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306216816.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306488948.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306339731.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306416301.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306158695.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306247274.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306384385.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306125466.0000000005380000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306447674.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306522725.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306584518.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306611590.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306185319.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306281192.0000000005384000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/u
Source: anyname.exe, 00000001.00000003.306557310.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307218412.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307110201.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307170119.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307135343.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307270002.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307071537.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306584518.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307193624.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306611590.0000000005384000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: anyname.exe, 00000001.00000003.307218412.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307110201.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307170119.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307135343.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307270002.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307193624.0000000005385000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comFj
Source: anyname.exe, 00000001.00000003.307218412.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307110201.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307170119.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307135343.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307270002.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307071537.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307193624.0000000005385000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comI.TTF
Source: anyname.exe, 00000001.00000002.342505137.000000000538A000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.336787753.0000000005387000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.coma2
Source: anyname.exe, 00000001.00000003.306158695.0000000005384000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.coma=
Source: anyname.exe, 00000001.00000003.307218412.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307110201.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307170119.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307135343.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307270002.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307193624.0000000005385000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comalic
Source: anyname.exe, 00000001.00000003.306557310.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306216816.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306488948.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306339731.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306416301.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306908381.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306247274.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306384385.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306974365.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306447674.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306522725.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306584518.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306611590.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306185319.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306281192.0000000005384000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comcoma=
Source: anyname.exe, 00000001.00000003.306557310.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306522725.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306584518.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306611590.0000000005384000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comcomd
Source: anyname.exe, 00000001.00000003.306281192.0000000005384000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comd
Source: anyname.exe, 00000001.00000003.306557310.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307705902.0000000005373000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307218412.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307110201.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306908381.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307047335.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307170119.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307135343.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307270002.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306974365.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307012712.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306522725.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307071537.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306584518.0000000005384000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307193624.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.306611590.0000000005384000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comdc
Source: anyname.exe, 00000001.00000003.306125466.0000000005380000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comgrita=
Source: anyname.exe, 00000001.00000003.307218412.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307110201.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307047335.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307170119.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307135343.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307270002.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307012712.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307071537.0000000005385000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.307193624.0000000005385000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comitud
Source: anyname.exe, 00000001.00000002.342505137.000000000538A000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.336787753.0000000005387000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comld
Source: anyname.exe, 00000001.00000002.342505137.000000000538A000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.336787753.0000000005387000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.commom
Source: anyname.exe, 00000001.00000002.342505137.000000000538A000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.336787753.0000000005387000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.como
Source: anyname.exe, 00000001.00000003.307270002.0000000005385000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comrsiv
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: anyname.exe, 00000001.00000003.302877241.0000000005372000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn9
Source: anyname.exe, 00000001.00000003.302877241.0000000005372000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnd
Source: anyname.exe, 00000001.00000003.308329187.000000000537D000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: anyname.exe, 00000001.00000003.304310308.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: anyname.exe, 00000001.00000003.304640191.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304505516.0000000005383000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304121443.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304198095.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304527460.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304377221.000000000537D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304187285.0000000005391000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304449883.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304310308.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/#
Source: anyname.exe, 00000001.00000003.304121443.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304034173.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304002699.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.303924115.0000000005392000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/%7
Source: anyname.exe, 00000001.00000003.303718023.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304640191.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304505516.0000000005383000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304121443.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304198095.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304527460.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304377221.000000000537D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304034173.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.303741179.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304002699.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.303924115.0000000005392000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304187285.0000000005391000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304449883.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304310308.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: anyname.exe, 00000001.00000003.303718023.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304640191.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304813720.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304505516.0000000005383000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304121443.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304726542.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304198095.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304778818.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304527460.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304377221.000000000537D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304034173.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304864654.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.303741179.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304002699.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.303924115.0000000005392000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304187285.0000000005391000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304449883.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304310308.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/2
Source: anyname.exe, 00000001.00000003.304121443.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304198095.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304034173.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304002699.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.303924115.0000000005392000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304187285.0000000005391000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304310308.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/N
Source: anyname.exe, 00000001.00000003.304640191.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304505516.0000000005383000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304527460.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304377221.000000000537D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304449883.0000000005381000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y
Source: anyname.exe, 00000001.00000003.304640191.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304813720.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304505516.0000000005383000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304726542.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304198095.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304778818.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304527460.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304377221.000000000537D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304864654.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304187285.0000000005391000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304449883.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304310308.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: anyname.exe, 00000001.00000003.304121443.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304198095.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304187285.0000000005391000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304310308.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/
Source: anyname.exe, 00000001.00000003.304121443.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304034173.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304002699.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.303924115.0000000005392000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/fi-fj
Source: anyname.exe, 00000001.00000003.305479835.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304640191.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304813720.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304505516.0000000005383000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.305305998.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304726542.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304198095.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304778818.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304935196.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304527460.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304377221.000000000537D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.305193401.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304864654.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.305379502.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304993341.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.305244460.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304187285.0000000005391000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.305125471.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304449883.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.305058733.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304310308.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/j
Source: anyname.exe, 00000001.00000003.303718023.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304640191.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304813720.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304505516.0000000005383000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304121443.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304726542.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304198095.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304778818.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304527460.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304377221.000000000537D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304034173.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304864654.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.303741179.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304002699.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.303924115.0000000005392000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304187285.0000000005391000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304449883.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304310308.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: anyname.exe, 00000001.00000003.304640191.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304813720.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304505516.0000000005383000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304726542.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304778818.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304935196.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304527460.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304377221.000000000537D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.305193401.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304864654.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304993341.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.305244460.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.305125471.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304449883.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.305058733.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/N
Source: anyname.exe, 00000001.00000003.304640191.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304505516.0000000005383000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304121443.0000000005393000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304198095.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304527460.000000000538C000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304377221.000000000537D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304034173.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304002699.000000000538D000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304187285.0000000005391000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304449883.0000000005381000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304310308.0000000005393000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/u
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.301360086.0000000005392000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp, anyname.exe, 00000001.00000003.304620293.0000000005383000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: anyname.exe, 00000001.00000002.342544948.0000000006582000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: anyname.exe, 00000006.00000002.823366416.0000000002DD1000.00000004.00000001.sdmp, jNnIJrO.exe, 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%
Source: jNnIJrO.exe, 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: jNnIJrO.exe, 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp, jNnIJrO.exe, 00000012.00000002.825746785.000000000343E000.00000004.00000001.sdmp String found in binary or memory: https://pZXqS7KWMFA4rh4s.net
Source: jNnIJrO.exe, 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp String found in binary or memory: https://pZXqS7KWMFA4rh4s.net$
Source: anyname.exe, 00000001.00000002.339301678.0000000003449000.00000004.00000001.sdmp, anyname.exe, 00000006.00000002.818827980.0000000000402000.00000040.00000001.sdmp, anyname.exe, 00000006.00000000.333358376.0000000000402000.00000040.00000001.sdmp, jNnIJrO.exe, 0000000A.00000002.421939439.0000000003C69000.00000004.00000001.sdmp, jNnIJrO.exe, 0000000E.00000002.437781088.0000000000402000.00000040.00000001.sdmp, jNnIJrO.exe, 0000000E.00000000.412466130.0000000000402000.00000040.00000001.sdmp, jNnIJrO.exe, 00000010.00000002.437858484.0000000003819000.00000004.00000001.sdmp, jNnIJrO.exe, 00000012.00000000.432184199.0000000000402000.00000040.00000001.sdmp, jNnIJrO.exe, 00000012.00000000.429637125.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: anyname.exe, 00000006.00000002.823366416.0000000002DD1000.00000004.00000001.sdmp, jNnIJrO.exe, 0000000E.00000002.439216232.0000000002FE1000.00000004.00000001.sdmp, jNnIJrO.exe, 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown DNS traffic detected: queries for: mail.gnvmetalica.pe

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\anyname.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Window created: window name: CLIPBRDWNDCLASS

System Summary:

barindex
.NET source code contains very large array initializations
Source: 6.0.anyname.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007bF4C6BC43u002d451Du002d4C27u002dA83Au002d8385F6B71886u007d/u0033EB7A67Cu002d4401u002d43FCu002d899Bu002dD2C8FBEB686A.cs Large array initialization: .cctor: array initializer size 11957
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_014D46A0 6_2_014D46A0
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_014D3D50 6_2_014D3D50
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_014D4630 6_2_014D4630
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_014D4690 6_2_014D4690
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_014DDA01 6_2_014DDA01
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_0530E238 6_2_0530E238
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_0530ACF8 6_2_0530ACF8
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_06146C70 6_2_06146C70
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_061494F8 6_2_061494F8
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_06147540 6_2_06147540
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_06146928 6_2_06146928
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_067B16E8 6_2_067B16E8
Java / VBScript file with very long strings (likely obfuscated code)
Source: TGFTR.vbs Initial sample: Strings found which are bigger than 50
Source: anyname.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: jNnIJrO.exe.6.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: TGFTR.vbs ReversingLabs: Detection: 39%
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\TGFTR.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe "C:\Users\user\AppData\Local\Temp\anyname.exe"
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe "C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe"
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process created: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe "C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe"
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process created: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe "C:\Users\user\AppData\Local\Temp\anyname.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process created: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process created: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\anyname.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\anyname.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\anyname.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\anyname.exe.log Jump to behavior
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\anyname.exe Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winVBS@17/7@4/1
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\TGFTR.vbs"
Source: 6.0.anyname.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.0.anyname.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\AppData\Local\Temp\anyname.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior

Data Obfuscation:

barindex
VBScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: \AppData\Local\Temp\anyname.exe", "2");IWshShell3.Run("C:\Users\user\AppData\Local\Temp\anyname.exe")
.NET source code contains potential unpacker
Source: anyname.exe.0.dr, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.anyname.exe.10000.0.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.anyname.exe.10000.0.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.anyname.exe.1a0000.2.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.anyname.exe.1a0000.1.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.anyname.exe.1a0000.3.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.anyname.exe.1a0000.0.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.anyname.exe.1a0000.0.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.anyname.exe.150000.3.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.anyname.exe.150000.0.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.anyname.exe.150000.0.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.anyname.exe.150000.1.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.anyname.exe.150000.2.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.anyname.exe.190000.3.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.anyname.exe.190000.0.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.anyname.exe.190000.2.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.anyname.exe.190000.1.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.anyname.exe.190000.0.unpack, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: jNnIJrO.exe.6.dr, Windows/MainForm.cs .Net Code: POERCX_31424 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 1_2_00016EE0 push cs; retf 1_2_00016F1A
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 3_2_001A6EE0 push cs; retf 3_2_001A6F1A
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 4_2_00156EE0 push cs; retf 4_2_00156F1A
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 5_2_00196EE0 push cs; retf 5_2_00196F1A
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_00A06EE0 push cs; retf 6_2_00A06F1A
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_06148540 push es; ret 6_2_06148550
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Code function: 10_2_00756EE0 push cs; retf 10_2_00756F1A
Source: initial sample Static PE information: section name: .text entropy: 7.96488968288
Source: initial sample Static PE information: section name: .text entropy: 7.96488968288

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\anyname.exe File created: C:\Users\user\AppData\Local\Temp\tmpG259.tmp (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\anyname.exe File created: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Jump to dropped file
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\anyname.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run jNnIJrO Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run jNnIJrO Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\AppData\Local\Temp\anyname.exe File opened: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\wscript.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 10.2.jNnIJrO.exe.2c92d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.anyname.exe.2472cf4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.anyname.exe.247ad00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.jNnIJrO.exe.2c9ad1c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.jNnIJrO.exe.2842d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.jNnIJrO.exe.284ad1c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.435288395.0000000002811000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.420006231.0000000002C61000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.338630738.0000000002441000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: anyname.exe PID: 6000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 5952, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 5280, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: anyname.exe, 00000001.00000002.338630738.0000000002441000.00000004.00000001.sdmp, jNnIJrO.exe, 0000000A.00000002.420006231.0000000002C61000.00000004.00000001.sdmp, jNnIJrO.exe, 00000010.00000002.435288395.0000000002811000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: anyname.exe, 00000001.00000002.338630738.0000000002441000.00000004.00000001.sdmp, jNnIJrO.exe, 0000000A.00000002.420006231.0000000002C61000.00000004.00000001.sdmp, jNnIJrO.exe, 00000010.00000002.435288395.0000000002811000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\anyname.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\anyname.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\anyname.exe TID: 400 Thread sleep time: -38135s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe TID: 5480 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe TID: 6448 Thread sleep time: -19369081277395017s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe TID: 6584 Thread sleep count: 3203 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe TID: 6584 Thread sleep count: 6652 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe TID: 6300 Thread sleep time: -40853s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe TID: 1980 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe TID: 4556 Thread sleep time: -34703s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe TID: 5796 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe TID: 7068 Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe TID: 6012 Thread sleep count: 2042 > 30
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe TID: 6012 Thread sleep count: 7810 > 30
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Window / User API: threadDelayed 3203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Window / User API: threadDelayed 6652 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Window / User API: threadDelayed 2042
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Window / User API: threadDelayed 7810
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\anyname.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\anyname.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\anyname.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Thread delayed: delay time: 38135 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Thread delayed: delay time: 40853 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Thread delayed: delay time: 34703 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Thread delayed: delay time: 922337203685477
Source: jNnIJrO.exe, 00000010.00000002.435288395.0000000002811000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: jNnIJrO.exe, 00000012.00000002.822956172.0000000001550000.00000004.00000010.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll6
Source: jNnIJrO.exe, 00000010.00000002.435288395.0000000002811000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: jNnIJrO.exe, 00000010.00000002.435288395.0000000002811000.00000004.00000001.sdmp Binary or memory string: vmware
Source: anyname.exe, 00000006.00000002.822114532.0000000001264000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlllter-0000
Source: jNnIJrO.exe, 00000010.00000002.435288395.0000000002811000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_0614FBF0 LdrInitializeThunk, 6_2_0614FBF0
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Benign windows process drops PE files
Source: C:\Windows\System32\wscript.exe File created: anyname.exe.0.dr Jump to dropped file
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Memory written: C:\Users\user\AppData\Local\Temp\anyname.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Memory written: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Memory written: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe "C:\Users\user\AppData\Local\Temp\anyname.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Process created: C:\Users\user\AppData\Local\Temp\anyname.exe C:\Users\user\AppData\Local\Temp\anyname.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process created: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Process created: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Jump to behavior
Source: anyname.exe, 00000006.00000002.822929398.00000000018C0000.00000002.00020000.sdmp, jNnIJrO.exe, 00000012.00000002.823321744.00000000019E0000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: anyname.exe, 00000006.00000002.822929398.00000000018C0000.00000002.00020000.sdmp, jNnIJrO.exe, 00000012.00000002.823321744.00000000019E0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: anyname.exe, 00000006.00000002.822929398.00000000018C0000.00000002.00020000.sdmp, jNnIJrO.exe, 00000012.00000002.823321744.00000000019E0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: anyname.exe, 00000006.00000002.822929398.00000000018C0000.00000002.00020000.sdmp, jNnIJrO.exe, 00000012.00000002.823321744.00000000019E0000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Users\user\AppData\Local\Temp\anyname.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Users\user\AppData\Local\Temp\anyname.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Code function: 6_2_06145A94 GetUserNameW, 6_2_06145A94

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 14.0.jNnIJrO.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.anyname.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.jNnIJrO.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.jNnIJrO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.jNnIJrO.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.jNnIJrO.exe.3a9f700.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.anyname.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.anyname.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.jNnIJrO.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.jNnIJrO.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.jNnIJrO.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.jNnIJrO.exe.3bd5498.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.jNnIJrO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.anyname.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.anyname.exe.3805498.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.anyname.exe.3805498.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.jNnIJrO.exe.4025498.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.jNnIJrO.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.jNnIJrO.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.jNnIJrO.exe.4025498.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.jNnIJrO.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.jNnIJrO.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.anyname.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.anyname.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.jNnIJrO.exe.3bd5498.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.anyname.exe.36cf700.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.jNnIJrO.exe.3eef700.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.jNnIJrO.exe.38b6768.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.jNnIJrO.exe.3d06768.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.anyname.exe.34e6768.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.339301678.0000000003449000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.414176975.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.437781088.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.413072340.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.818827980.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.432184199.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.334391664.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.412466130.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.333862225.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.430664818.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.431529327.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.335234290.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.415518300.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.818828907.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.333358376.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.429637125.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.437858484.0000000003819000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.421939439.0000000003C69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.823366416.0000000002DD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.439216232.0000000002FE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: anyname.exe PID: 6000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: anyname.exe PID: 5608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 5952, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 2276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 5280, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 6456, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\anyname.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\anyname.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Users\user\AppData\Roaming\jNnIJrO\jNnIJrO.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.823366416.0000000002DD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.439216232.0000000002FE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: anyname.exe PID: 5608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 2276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 6456, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 14.0.jNnIJrO.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.anyname.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.jNnIJrO.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.jNnIJrO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.jNnIJrO.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.jNnIJrO.exe.3a9f700.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.anyname.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.anyname.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.jNnIJrO.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.jNnIJrO.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.jNnIJrO.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.jNnIJrO.exe.3bd5498.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.jNnIJrO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.anyname.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.anyname.exe.3805498.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.anyname.exe.3805498.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.jNnIJrO.exe.4025498.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.jNnIJrO.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.jNnIJrO.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.jNnIJrO.exe.4025498.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.jNnIJrO.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.jNnIJrO.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.anyname.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.anyname.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.jNnIJrO.exe.3bd5498.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.anyname.exe.36cf700.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.jNnIJrO.exe.3eef700.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.jNnIJrO.exe.38b6768.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.jNnIJrO.exe.3d06768.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.anyname.exe.34e6768.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.339301678.0000000003449000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.414176975.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.437781088.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.413072340.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.818827980.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.432184199.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.334391664.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.412466130.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.333862225.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.430664818.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.431529327.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.335234290.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.415518300.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.818828907.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.333358376.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.429637125.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.437858484.0000000003819000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.421939439.0000000003C69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.824325494.00000000030E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.823366416.0000000002DD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.439216232.0000000002FE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: anyname.exe PID: 6000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: anyname.exe PID: 5608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 5952, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 2276, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 5280, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jNnIJrO.exe PID: 6456, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 546894 Sample: TGFTR.vbs Startdate: 01/01/2022 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Multi AV Scanner detection for dropped file 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 6 other signatures 2->50 7 wscript.exe 2 2->7         started        11 jNnIJrO.exe 2 2->11         started        13 jNnIJrO.exe 3 2->13         started        process3 file4 34 C:\Users\user\AppData\Local\...\anyname.exe, PE32 7->34 dropped 52 Benign windows process drops PE files 7->52 54 VBScript performs obfuscated calls to suspicious functions 7->54 15 anyname.exe 3 7->15         started        56 Injects a PE file into a foreign processes 11->56 18 jNnIJrO.exe 6 11->18         started        58 Multi AV Scanner detection for dropped file 13->58 60 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 13->60 62 Machine Learning detection for dropped file 13->62 64 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 13->64 21 jNnIJrO.exe 2 13->21         started        signatures5 process6 dnsIp7 74 Multi AV Scanner detection for dropped file 15->74 76 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->76 78 Machine Learning detection for dropped file 15->78 86 2 other signatures 15->86 23 anyname.exe 2 8 15->23         started        28 anyname.exe 15->28         started        30 anyname.exe 15->30         started        32 anyname.exe 15->32         started        40 mail.gnvmetalica.pe 18->40 80 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->80 82 Tries to steal Mail credentials (via file / registry access) 18->82 84 Tries to harvest and steal ftp login credentials 18->84 88 2 other signatures 18->88 signatures8 process9 dnsIp10 42 mail.gnvmetalica.pe 162.241.148.206, 49799, 49800, 49803 UNIFIEDLAYER-AS-1US United States 23->42 36 C:\Users\user\AppData\Roaming\...\jNnIJrO.exe, PE32 23->36 dropped 38 C:\Users\user\AppData\...\tmpG259.tmp (copy), PE32 23->38 dropped 66 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->66 68 Tries to steal Mail credentials (via file / registry access) 23->68 70 Hides that the sample has been downloaded from the Internet (zone.identifier) 23->70 72 Installs a global keyboard hook 23->72 file11 signatures12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.241.148.206
 mail.gnvmetalica.pe United States
46606 UNIFIEDLAYER-AS-1US false

Contacted Domains

Name IP Active
mail.gnvmetalica.pe 162.241.148.206 true