Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report V5Al4cc8RL

Overview

General Information

Sample Name:V5Al4cc8RL (renamed file extension from none to exe)
Analysis ID:552874
MD5:5b8c247358c809a35edfc69ce74ea5c7
SHA1:663b2a00733f4ab4af9e73c948a14aacaa3d4c6e
SHA256:23c7ee11b32f31b5b6bb9c94af7250d3c8edaccb70ab9472d15a3a9ae2ee3b8d
Tags:32exetrojan
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • V5Al4cc8RL.exe (PID: 6220 cmdline: "C:\Users\user\Desktop\V5Al4cc8RL.exe" MD5: 5B8C247358C809A35EDFC69CE74EA5C7)
    • V5Al4cc8RL.exe (PID: 6512 cmdline: C:\Users\user\Desktop\V5Al4cc8RL.exe MD5: 5B8C247358C809A35EDFC69CE74EA5C7)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "hisgraceinme@yandex.com", "Password": "newyear2022", "Host": "smtp.yandex.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.497968057.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000004.00000002.497968057.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000000.00000002.257945194.0000000002B07000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000004.00000000.255852649.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000004.00000000.255852649.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
            Click to see the 15 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            4.2.V5Al4cc8RL.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              4.2.V5Al4cc8RL.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                4.0.V5Al4cc8RL.exe.400000.6.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  4.0.V5Al4cc8RL.exe.400000.6.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    0.2.V5Al4cc8RL.exe.2b51724.2.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
                      Click to see the 17 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 4.0.V5Al4cc8RL.exe.400000.12.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "hisgraceinme@yandex.com", "Password": "newyear2022", "Host": "smtp.yandex.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: V5Al4cc8RL.exeVirustotal: Detection: 33%Perma Link
                      Source: V5Al4cc8RL.exeReversingLabs: Detection: 41%
                      Machine Learning detection for sampleShow sources
                      Source: V5Al4cc8RL.exeJoe Sandbox ML: detected
                      Source: 4.0.V5Al4cc8RL.exe.400000.12.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.0.V5Al4cc8RL.exe.400000.8.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.2.V5Al4cc8RL.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.0.V5Al4cc8RL.exe.400000.6.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.0.V5Al4cc8RL.exe.400000.4.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.0.V5Al4cc8RL.exe.400000.10.unpackAvira: Label: TR/Spy.Gen8
                      Source: V5Al4cc8RL.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: V5Al4cc8RL.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Joe Sandbox ViewIP Address: 77.88.21.158 77.88.21.158
                      Source: global trafficTCP traffic: 192.168.2.5:49836 -> 77.88.21.158:587
                      Source: global trafficTCP traffic: 192.168.2.5:49836 -> 77.88.21.158:587
                      Source: V5Al4cc8RL.exe, 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: V5Al4cc8RL.exe, 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: V5Al4cc8RL.exe, 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmpString found in binary or memory: http://QBAAYx.com
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://crl.certum.pl/ca.crl0h
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
                      Source: V5Al4cc8RL.exe, 00000000.00000003.235602973.0000000005AD6000.00000004.00000001.sdmpString found in binary or memory: http://en.wPTf
                      Source: V5Al4cc8RL.exe, 00000000.00000003.235089237.0000000005AF2000.00000004.00000001.sdmpString found in binary or memory: http://en.wikipedia
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://repository.certum.pl/ca.cer09
                      Source: V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://repository.certum.pl/ca4
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://repository.certum.pl/ycasha2.cer0
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507040750.0000000002DAE000.00000004.00000001.sdmpString found in binary or memory: http://smtp.yandex.com
                      Source: V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://subca.ocs-
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://subca.ocsp-certum.com0.
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238151607.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238082880.0000000005AD7000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://www.certum.pl/CPS0
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242524112.0000000005ADE000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242181300.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242431858.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmljC1
                      Source: V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlu-hu-d
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: V5Al4cc8RL.exe, 00000000.00000003.242181300.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242431858.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlJ
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: V5Al4cc8RL.exe, 00000000.00000003.242524112.0000000005ADE000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.243646078.0000000005ADC000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF
                      Source: V5Al4cc8RL.exe, 00000000.00000003.242524112.0000000005ADE000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242181300.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242431858.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF9D
                      Source: V5Al4cc8RL.exe, 00000000.00000003.242524112.0000000005ADE000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comalsd
                      Source: V5Al4cc8RL.exe, 00000000.00000003.247569775.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.261731654.0000000005AD0000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.247686760.0000000005AD7000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comasno
                      Source: V5Al4cc8RL.exe, 00000000.00000003.242431858.0000000005ADC000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comcomF
                      Source: V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd6D
                      Source: V5Al4cc8RL.exe, 00000000.00000003.247271696.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.247569775.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.261731654.0000000005AD0000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.247686760.0000000005AD7000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comdia6D
                      Source: V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comituF
                      Source: V5Al4cc8RL.exe, 00000000.00000003.247271696.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.247569775.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.247686760.0000000005AD7000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.como
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: V5Al4cc8RL.exe, 00000000.00000003.237362893.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237519809.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237445278.0000000005AD8000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: V5Al4cc8RL.exe, 00000000.00000003.237519809.0000000005AD7000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn2
                      Source: V5Al4cc8RL.exe, 00000000.00000003.237519809.0000000005AD7000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnFROM
                      Source: V5Al4cc8RL.exe, 00000000.00000003.237519809.0000000005AD7000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnJ
                      Source: V5Al4cc8RL.exe, 00000000.00000003.237519809.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237445278.0000000005AD8000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnva
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: V5Al4cc8RL.exe, 00000000.00000003.239487614.0000000005ADD000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238669999.0000000005ADB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.239393407.0000000005ADD000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: V5Al4cc8RL.exe, 00000000.00000003.239487614.0000000005ADD000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.239393407.0000000005ADD000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp//
                      Source: V5Al4cc8RL.exe, 00000000.00000003.239487614.0000000005ADD000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.239393407.0000000005ADD000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                      Source: V5Al4cc8RL.exe, 00000000.00000003.238669999.0000000005ADB000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/n-u
                      Source: V5Al4cc8RL.exe, 00000000.00000003.235374791.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236344812.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236022823.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236658890.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236259831.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236566208.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236536316.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236788828.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235613845.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237785650.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237422103.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236732771.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236508751.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235845119.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238068440.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237645057.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238438414.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237214547.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236975965.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235789156.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238478134.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238541470.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238649245.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236679295.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236075154.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236291815.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235985152.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236618636.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236897959.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235466855.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237931677.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236440918.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238140250.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235418141.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235725240.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235314851.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238736518.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237721608.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235521691.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236393828.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235657356.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238766071.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235946333.0000000005AEB000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: V5Al4cc8RL.exe, 00000000.00000003.235374791.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236344812.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236022823.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236658890.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236259831.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236566208.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236536316.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236788828.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235613845.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237785650.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237422103.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236732771.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236508751.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235845119.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238068440.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237645057.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238438414.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237214547.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236975965.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235789156.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238478134.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238541470.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238649245.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236679295.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236075154.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236291815.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235985152.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236618636.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236897959.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235466855.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237931677.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236440918.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238140250.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235418141.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235725240.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235314851.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238736518.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237721608.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235521691.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236393828.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235657356.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238766071.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235946333.0000000005AEB000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.come
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: http://yandex.ocsp-responder.com03
                      Source: V5Al4cc8RL.exe, 00000004.00000002.506919005.0000000002D5B000.00000004.00000001.sdmpString found in binary or memory: https://T2RlCNQDaV0Ojub.com
                      Source: V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpString found in binary or memory: https://www.certum.pl/CPS0
                      Source: V5Al4cc8RL.exe, 00000000.00000002.258273747.0000000003A99000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.497968057.0000000000402000.00000040.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000000.254143628.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: V5Al4cc8RL.exe, 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: unknownDNS traffic detected: queries for: smtp.yandex.com
                      Source: V5Al4cc8RL.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_028C3A24
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_028CE8E0
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_028CE8F0
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_028CCF14
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_028C6C81
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D70958
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D776C8
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D7BE68
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D78888
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D7E3A9
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D9B43C
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D9DEC0
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D91FF0
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D9AB70
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D92768
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00F40C71
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00F44DA0
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00F4C140
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00F4B690
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00F48320
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00F455E6
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00F455E8
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00F4BD28
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00F4DE60
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00F4AB21
                      Source: V5Al4cc8RL.exeBinary or memory string: OriginalFilename vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exe, 00000000.00000002.257831013.0000000002A91000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamehnoksqXHWDvXLXQGJLwfmNUry.exe4 vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exe, 00000000.00000002.256860396.0000000000762000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamePolicyLev.exe< vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exe, 00000000.00000002.262709097.00000000091A0000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameUI.dllF vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exe, 00000000.00000002.258273747.0000000003A99000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamehnoksqXHWDvXLXQGJLwfmNUry.exe4 vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exe, 00000000.00000002.258273747.0000000003A99000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUI.dllF vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exeBinary or memory string: OriginalFilename vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exe, 00000004.00000002.498271939.0000000000682000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamePolicyLev.exe< vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exe, 00000004.00000002.497968057.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamehnoksqXHWDvXLXQGJLwfmNUry.exe4 vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exe, 00000004.00000002.502687417.0000000000AF8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exeBinary or memory string: OriginalFilenamePolicyLev.exe< vs V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: V5Al4cc8RL.exeVirustotal: Detection: 33%
                      Source: V5Al4cc8RL.exeReversingLabs: Detection: 41%
                      Source: V5Al4cc8RL.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: unknownProcess created: C:\Users\user\Desktop\V5Al4cc8RL.exe "C:\Users\user\Desktop\V5Al4cc8RL.exe"
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess created: C:\Users\user\Desktop\V5Al4cc8RL.exe C:\Users\user\Desktop\V5Al4cc8RL.exe
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess created: C:\Users\user\Desktop\V5Al4cc8RL.exe C:\Users\user\Desktop\V5Al4cc8RL.exe
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\V5Al4cc8RL.exe.logJump to behavior
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@2/1
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: V5Al4cc8RL.exe, 00000000.00000003.245108131.0000000005AFC000.00000004.00000001.sdmpBinary or memory string: of The Monotype Corporation.slnt
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: V5Al4cc8RL.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: V5Al4cc8RL.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: V5Al4cc8RL.exe, ContextForm/AutoMachine.cs.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 0.2.V5Al4cc8RL.exe.760000.0.unpack, ContextForm/AutoMachine.cs.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 0.0.V5Al4cc8RL.exe.760000.0.unpack, ContextForm/AutoMachine.cs.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 4.0.V5Al4cc8RL.exe.680000.13.unpack, ContextForm/AutoMachine.cs.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 4.0.V5Al4cc8RL.exe.680000.11.unpack, ContextForm/AutoMachine.cs.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 4.0.V5Al4cc8RL.exe.680000.2.unpack, ContextForm/AutoMachine.cs.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 4.0.V5Al4cc8RL.exe.680000.0.unpack, ContextForm/AutoMachine.cs.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 4.0.V5Al4cc8RL.exe.680000.5.unpack, ContextForm/AutoMachine.cs.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 4.0.V5Al4cc8RL.exe.680000.9.unpack, ContextForm/AutoMachine.cs.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_00765123 push edi; retf
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_00765305 pushad ; retf
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_0076430A push esp; ret
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_007662B6 push ecx; iretd
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_007642AB push esi; retf
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 0_2_028CD0C0 push eax; retf
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00685123 push edi; retf
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_0068430A push esp; ret
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00685305 pushad ; retf
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_006842AB push esi; retf
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_006862B6 push ecx; iretd
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D97A37 push edi; retn 0000h
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.56350374002
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 0.2.V5Al4cc8RL.exe.2b51724.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.V5Al4cc8RL.exe.2afb594.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.257945194.0000000002B07000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.257831013.0000000002A91000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: V5Al4cc8RL.exe PID: 6220, type: MEMORYSTR
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: V5Al4cc8RL.exe, 00000000.00000002.257945194.0000000002B07000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.257831013.0000000002A91000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: V5Al4cc8RL.exe, 00000000.00000002.257945194.0000000002B07000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.257831013.0000000002A91000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exe TID: 6224Thread sleep time: -35259s >= -30000s
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exe TID: 6264Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exe TID: 7044Thread sleep time: -23980767295822402s >= -30000s
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exe TID: 7060Thread sleep count: 2706 > 30
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exe TID: 7060Thread sleep count: 7080 > 30
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exe TID: 7044Thread sleep count: 43 > 30
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeWindow / User API: threadDelayed 2706
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeWindow / User API: threadDelayed 7080
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeThread delayed: delay time: 35259
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeThread delayed: delay time: 922337203685477
                      Source: V5Al4cc8RL.exe, 00000000.00000002.257831013.0000000002A91000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
                      Source: V5Al4cc8RL.exe, 00000000.00000002.257831013.0000000002A91000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: V5Al4cc8RL.exe, 00000000.00000002.257831013.0000000002A91000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: V5Al4cc8RL.exe, 00000000.00000002.257831013.0000000002A91000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeCode function: 4_2_00D7C8A8 LdrInitializeThunk,
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeMemory written: C:\Users\user\Desktop\V5Al4cc8RL.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeProcess created: C:\Users\user\Desktop\V5Al4cc8RL.exe C:\Users\user\Desktop\V5Al4cc8RL.exe
                      Source: V5Al4cc8RL.exe, 00000004.00000002.505613360.0000000001470000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: V5Al4cc8RL.exe, 00000004.00000002.505613360.0000000001470000.00000002.00020000.sdmpBinary or memory string: Progman
                      Source: V5Al4cc8RL.exe, 00000004.00000002.505613360.0000000001470000.00000002.00020000.sdmpBinary or memory string: SProgram Managerl
                      Source: V5Al4cc8RL.exe, 00000004.00000002.505613360.0000000001470000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd,
                      Source: V5Al4cc8RL.exe, 00000004.00000002.505613360.0000000001470000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Users\user\Desktop\V5Al4cc8RL.exe VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Users\user\Desktop\V5Al4cc8RL.exe VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 4.2.V5Al4cc8RL.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.V5Al4cc8RL.exe.400000.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.V5Al4cc8RL.exe.400000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.V5Al4cc8RL.exe.400000.10.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.V5Al4cc8RL.exe.3af50f0.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.V5Al4cc8RL.exe.400000.8.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.V5Al4cc8RL.exe.3b2b110.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.V5Al4cc8RL.exe.400000.12.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.V5Al4cc8RL.exe.3b2b110.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.V5Al4cc8RL.exe.3af50f0.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000004.00000002.497968057.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.255852649.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.255239710.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.254686523.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.254143628.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.258273747.0000000003A99000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: V5Al4cc8RL.exe PID: 6220, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: V5Al4cc8RL.exe PID: 6512, type: MEMORYSTR
                      Tries to steal Mail credentials (via file / registry access)Show sources
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                      Tries to harvest and steal ftp login credentialsShow sources
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                      Source: C:\Users\user\Desktop\V5Al4cc8RL.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                      Source: Yara matchFile source: 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: V5Al4cc8RL.exe PID: 6512, type: MEMORYSTR

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 4.2.V5Al4cc8RL.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.V5Al4cc8RL.exe.400000.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.V5Al4cc8RL.exe.400000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.V5Al4cc8RL.exe.400000.10.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.V5Al4cc8RL.exe.3af50f0.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.V5Al4cc8RL.exe.400000.8.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.V5Al4cc8RL.exe.3b2b110.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.V5Al4cc8RL.exe.400000.12.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.V5Al4cc8RL.exe.3b2b110.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.V5Al4cc8RL.exe.3af50f0.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000004.00000002.497968057.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.255852649.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.255239710.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.254686523.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.254143628.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.258273747.0000000003A99000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: V5Al4cc8RL.exe PID: 6220, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: V5Al4cc8RL.exe PID: 6512, type: MEMORYSTR

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Path InterceptionProcess Injection112Masquerading1OS Credential Dumping2Query Registry1Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1Credentials in Registry1Security Software Discovery211Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion131Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Local System2Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSVirtualization/Sandbox Evasion131Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol11SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information2LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonSoftware Packing13Cached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncSystem Information Discovery114Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      V5Al4cc8RL.exe34%VirustotalBrowse
                      V5Al4cc8RL.exe41%ReversingLabsByteCode-MSIL.Backdoor.NanoBot
                      V5Al4cc8RL.exe100%Joe Sandbox ML

                      Dropped Files

                      No Antivirus matches

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      4.0.V5Al4cc8RL.exe.400000.12.unpack100%AviraTR/Spy.Gen8Download File
                      4.0.V5Al4cc8RL.exe.400000.8.unpack100%AviraTR/Spy.Gen8Download File
                      4.2.V5Al4cc8RL.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                      4.0.V5Al4cc8RL.exe.400000.6.unpack100%AviraTR/Spy.Gen8Download File
                      4.0.V5Al4cc8RL.exe.400000.4.unpack100%AviraTR/Spy.Gen8Download File
                      4.0.V5Al4cc8RL.exe.400000.10.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://www.founder.com.cn/cnva0%Avira URL Cloudsafe
                      http://en.wPTf0%Avira URL Cloudsafe
                      http://www.founder.com.cn/cnJ0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.founder.com.cn/cnFROM0%Avira URL Cloudsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://subca.ocsp-certum.com0.0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp//0%URL Reputationsafe
                      http://subca.ocsp-certum.com010%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/n-u0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.sajatypeworks.come0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://www.fontbureau.comF9D0%Avira URL Cloudsafe
                      http://www.fontbureau.comalsd0%URL Reputationsafe
                      https://T2RlCNQDaV0Ojub.com0%Avira URL Cloudsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://www.fontbureau.comF0%URL Reputationsafe
                      http://www.fontbureau.comasno0%Avira URL Cloudsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://subca.ocs-0%Avira URL Cloudsafe
                      http://en.wikipedia0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://yandex.ocsp-responder.com030%URL Reputationsafe
                      http://www.fontbureau.comituF0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.fontbureau.comcomF0%URL Reputationsafe
                      http://www.founder.com.cn/cn20%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.fontbureau.como0%URL Reputationsafe
                      http://www.fontbureau.comdia6D0%Avira URL Cloudsafe
                      http://QBAAYx.com0%Avira URL Cloudsafe
                      http://www.fontbureau.comd6D0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      smtp.yandex.ru
                      		77.88.21.158
                      		truefalse
                        		high
                        smtp.yandex.com
                        		unknown
                        		unknownfalse
                          		high

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          http://127.0.0.1:HTTP/1.1V5Al4cc8RL.exe, 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		low
                          http://www.fontbureau.com/designersGV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                            		high
                            http://www.founder.com.cn/cnvaV5Al4cc8RL.exe, 00000000.00000003.237519809.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237445278.0000000005AD8000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://en.wPTfV5Al4cc8RL.exe, 00000000.00000003.235602973.0000000005AD6000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.com/designers/?V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                              		high
                              http://www.founder.com.cn/cnJV5Al4cc8RL.exe, 00000000.00000003.237519809.0000000005AD7000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.founder.com.cn/cn/bTheV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers?V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                		high
                                http://yandex.crl.certum.pl/ycasha2.crl0qV5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                  		high
                                  http://www.tiro.comV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.founder.com.cn/cnFROMV5Al4cc8RL.exe, 00000000.00000003.237519809.0000000005AD7000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fontbureau.com/designersV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                    		high
                                    http://www.goodfont.co.krV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.sajatypeworks.comV5Al4cc8RL.exe, 00000000.00000003.235374791.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236344812.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236022823.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236658890.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236259831.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236566208.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236536316.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236788828.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235613845.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237785650.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237422103.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236732771.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236508751.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235845119.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238068440.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237645057.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238438414.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237214547.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236975965.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235789156.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238478134.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238541470.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238649245.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236679295.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236075154.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236291815.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235985152.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236618636.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236897959.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235466855.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237931677.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236440918.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238140250.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235418141.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235725240.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235314851.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238736518.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237721608.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235521691.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236393828.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235657356.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238766071.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235946333.0000000005AEB000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://subca.ocsp-certum.com0.V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.typography.netDV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://repository.certum.pl/ca.cer09V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                      		high
                                      http://www.fontbureau.com/designers/frere-jones.htmlJV5Al4cc8RL.exe, 00000000.00000003.242181300.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242431858.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpfalse
                                        		high
                                        http://www.founder.com.cn/cn/cTheV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.galapagosdesign.com/staff/dennis.htmV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://fontfabrik.comV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.jiyu-kobo.co.jp//V5Al4cc8RL.exe, 00000000.00000003.239487614.0000000005ADD000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.239393407.0000000005ADD000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://subca.ocsp-certum.com01V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.jiyu-kobo.co.jp/n-uV5Al4cc8RL.exe, 00000000.00000003.238669999.0000000005ADB000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.galapagosdesign.com/DPleaseV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fonts.comV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                          		high
                                          http://www.sandoll.co.krV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.urwpp.deDPleaseV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.zhongyicts.com.cnV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.sajatypeworks.comeV5Al4cc8RL.exe, 00000000.00000003.235374791.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236344812.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236022823.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236658890.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236259831.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236566208.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236536316.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236788828.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235613845.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237785650.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237422103.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236732771.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236508751.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235845119.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238068440.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237645057.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238438414.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237214547.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236975965.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235789156.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238478134.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238541470.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238649245.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236679295.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236075154.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236291815.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235985152.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236618636.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236897959.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235466855.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237931677.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236440918.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238140250.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235418141.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235725240.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235314851.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238736518.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237721608.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235521691.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.236393828.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235657356.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238766071.0000000005AEB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.235946333.0000000005AEB000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.sakkal.comV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipV5Al4cc8RL.exe, 00000000.00000002.258273747.0000000003A99000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.497968057.0000000000402000.00000040.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000000.254143628.0000000000402000.00000040.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.certum.pl/CPS0V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                            		high
                                            http://www.fontbureau.comF9DV5Al4cc8RL.exe, 00000000.00000003.242524112.0000000005ADE000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242181300.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242431858.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.fontbureau.comalsdV5Al4cc8RL.exe, 00000000.00000003.242524112.0000000005ADE000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://repository.certum.pl/ycasha2.cer0V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                              		high
                                              http://www.apache.org/licenses/LICENSE-2.0V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238151607.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238082880.0000000005AD7000.00000004.00000001.sdmpfalse
                                                		high
                                                http://www.fontbureau.comV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242524112.0000000005ADE000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242181300.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242431858.0000000005ADC000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpfalse
                                                  		high
                                                  https://T2RlCNQDaV0Ojub.comV5Al4cc8RL.exe, 00000004.00000002.506919005.0000000002D5B000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://DynDns.comDynDNSV5Al4cc8RL.exe, 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.comFV5Al4cc8RL.exe, 00000000.00000003.242524112.0000000005ADE000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.243646078.0000000005ADC000.00000004.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://repository.certum.pl/ctnca.cer09V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                                    		high
                                                    http://www.fontbureau.comasnoV5Al4cc8RL.exe, 00000000.00000003.247569775.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.261731654.0000000005AD0000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.247686760.0000000005AD7000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haV5Al4cc8RL.exe, 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://crl.certum.pl/ctnca.crl0kV5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                                      		high
                                                      http://subca.ocs-V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		low
                                                      http://en.wikipediaV5Al4cc8RL.exe, 00000000.00000003.235089237.0000000005AF2000.00000004.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.fontbureau.com/designers/cabarga.htmlu-hu-dV5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpfalse
                                                        		high
                                                        https://www.certum.pl/CPS0V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                                          		high
                                                          http://www.jiyu-kobo.co.jp/jp/V5Al4cc8RL.exe, 00000000.00000003.239487614.0000000005ADD000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.239393407.0000000005ADD000.00000004.00000001.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://smtp.yandex.comV5Al4cc8RL.exe, 00000004.00000002.507040750.0000000002DAE000.00000004.00000001.sdmpfalse
                                                            		high
                                                            http://www.carterandcone.comlV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://yandex.ocsp-responder.com03V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://www.fontbureau.com/designers/cabarga.htmlNV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                                              		high
                                                              http://www.fontbureau.comituFV5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://www.founder.com.cn/cnV5Al4cc8RL.exe, 00000000.00000003.237362893.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237519809.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.237445278.0000000005AD8000.00000004.00000001.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://www.fontbureau.com/designers/frere-jones.htmlV5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                                                		high
                                                                http://crls.yandex.net/certum/ycasha2.crl0-V5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                                                  		high
                                                                  http://www.fontbureau.comcomFV5Al4cc8RL.exe, 00000000.00000003.242431858.0000000005ADC000.00000004.00000001.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  http://www.founder.com.cn/cn2V5Al4cc8RL.exe, 00000000.00000003.237519809.0000000005AD7000.00000004.00000001.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  http://www.jiyu-kobo.co.jp/V5Al4cc8RL.exe, 00000000.00000003.239487614.0000000005ADD000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.238669999.0000000005ADB000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.239393407.0000000005ADD000.00000004.00000001.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  http://www.fontbureau.comoV5Al4cc8RL.exe, 00000000.00000003.247271696.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.247569775.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.247686760.0000000005AD7000.00000004.00000001.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  http://www.fontbureau.com/designers8V5Al4cc8RL.exe, 00000000.00000002.262245650.0000000006CE2000.00000004.00000001.sdmpfalse
                                                                    		high
                                                                    http://www.fontbureau.comdia6DV5Al4cc8RL.exe, 00000000.00000003.247271696.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.247569775.0000000005AD7000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000002.261731654.0000000005AD0000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000000.00000003.247686760.0000000005AD7000.00000004.00000001.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://crl.certum.pl/ca.crl0hV5Al4cc8RL.exe, 00000004.00000002.507092323.0000000002DB6000.00000004.00000001.sdmp, V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                                                      		high
                                                                      http://QBAAYx.comV5Al4cc8RL.exe, 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      http://www.fontbureau.comd6DV5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      http://repository.certum.pl/ca4V5Al4cc8RL.exe, 00000004.00000002.503892448.0000000000CF1000.00000004.00000020.sdmpfalse
                                                                        		high
                                                                        http://www.fontbureau.com/designers/cabarga.htmljC1V5Al4cc8RL.exe, 00000000.00000003.242229742.0000000005ADD000.00000004.00000001.sdmpfalse
                                                                          		high

                                                                          Contacted IPs

                                                                          • No. of IPs < 25%
                                                                          • 25% < No. of IPs < 50%
                                                                          • 50% < No. of IPs < 75%
                                                                          • 75% < No. of IPs

                                                                          Public

                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                          77.88.21.158
                                                                          		smtp.yandex.ruRussian Federation
                                                                          		13238YANDEXRUfalse

                                                                          General Information

                                                                          Joe Sandbox Version:34.0.0 Boulder Opal
                                                                          Analysis ID:552874
                                                                          Start date:13.01.2022
                                                                          Start time:20:52:51
                                                                          Joe Sandbox Product:CloudBasic
                                                                          Overall analysis duration:0h 9m 37s
                                                                          Hypervisor based Inspection enabled:false
                                                                          Report type:light
                                                                          Sample file name:V5Al4cc8RL (renamed file extension from none to exe)
                                                                          Cookbook file name:default.jbs
                                                                          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                          Number of analysed new started processes analysed:27
                                                                          Number of new started drivers analysed:0
                                                                          Number of existing processes analysed:0
                                                                          Number of existing drivers analysed:0
                                                                          Number of injected processes analysed:0
                                                                          Technologies:
                                                                          • HCA enabled
                                                                          • EGA enabled
                                                                          • HDC enabled
                                                                          • AMSI enabled
                                                                          Analysis Mode:default
                                                                          Analysis stop reason:Timeout
                                                                          Detection:MAL
                                                                          Classification:mal100.troj.spyw.evad.winEXE@3/1@2/1
                                                                          EGA Information:
                                                                          • Successful, ratio: 100%
                                                                          HDC Information:
                                                                          • Successful, ratio: 1.9% (good quality ratio 1.1%)
                                                                          • Quality average: 43.1%
                                                                          • Quality standard deviation: 39.4%
                                                                          HCA Information:
                                                                          • Successful, ratio: 100%
                                                                          • Number of executed functions: 0
                                                                          • Number of non-executed functions: 0
                                                                          Cookbook Comments:
                                                                          • Adjust boot time
                                                                          • Enable AMSI
                                                                          Warnings:
                                                                          Show All
                                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                                          • Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200
                                                                          • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, www.bing.com, client.wns.windows.com, fs.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, dual-a-0001.a-msedge.net, www-bing-com.dual-a-0001.a-msedge.net, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                          • Report size getting too big, too many NtQueryValueKey calls found.

                                                                          Simulations

                                                                          Behavior and APIs

                                                                          TimeTypeDescription
                                                                          20:53:52API Interceptor664x Sleep call for process: V5Al4cc8RL.exe modified

                                                                          Joe Sandbox View / Context

                                                                          IPs

                                                                          No context

                                                                          Domains

                                                                          No context

                                                                          ASN

                                                                          No context

                                                                          JA3 Fingerprints

                                                                          No context

                                                                          Dropped Files

                                                                          No context

                                                                          Created / dropped Files

                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\V5Al4cc8RL.exe.log
                                                                          Process:C:\Users\user\Desktop\V5Al4cc8RL.exe
                                                                          File Type:ASCII text, with CRLF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):1310
                                                                          Entropy (8bit):5.345651901398759
                                                                          Encrypted:false
                                                                          SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE47mE4Ko88:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz6
                                                                          MD5:D918C6A765EDB90D2A227FE23A3FEC98
                                                                          SHA1:8BA802AD8D740F114783F0DADC407CBFD2A209B3
                                                                          SHA-256:AB0E9F716E31502A4C6786575C5E64DFD9D24AF99056BBE2640A2FA322CFF4D6
                                                                          SHA-512:A937ABD8294BB32A612F8B3A376C94111D688379F0A4DB9FAA2FCEB71C25E18D621EEBCFDA5706B71C8473A4F38D8B3C4005D1589B564F9B1C9C441B6D337814
                                                                          Malicious:true
                                                                          Reputation:moderate, very likely benign file
                                                                          Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                                                          Static File Info

                                                                          General

                                                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                          Entropy (8bit):7.553221581772884
                                                                          TrID:
                                                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                          • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                          • Windows Screen Saver (13104/52) 0.07%
                                                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                                                          File name:V5Al4cc8RL.exe
                                                                          File size:583680
                                                                          MD5:5b8c247358c809a35edfc69ce74ea5c7
                                                                          SHA1:663b2a00733f4ab4af9e73c948a14aacaa3d4c6e
                                                                          SHA256:23c7ee11b32f31b5b6bb9c94af7250d3c8edaccb70ab9472d15a3a9ae2ee3b8d
                                                                          SHA512:5cdabc9c8ef9bf6dcc43432cebf9c3852d4ed5331202e11187cb5eb094875cd6d2e97ecfa8f44f1e9b9f91866c203f6c190aec4ec960abab05e6bbf14f196305
                                                                          SSDEEP:12288:aHOZsCJFrxBQqap0aYeznd7qdE3P/VVSohhJeDbZOOhkK1MVLm3avxd4:zZ7sfC9mnd7P98ey
                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3..a..............0.............>.... ........@.. .......................@............@................................

                                                                          File Icon

                                                                          Icon Hash:00828e8e8686b000

                                                                          Static PE Info

                                                                          General

                                                                          Entrypoint:0x48fd3e
                                                                          Entrypoint Section:.text
                                                                          Digitally signed:false
                                                                          Imagebase:0x400000
                                                                          Subsystem:windows gui
                                                                          Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                                          DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                          Time Stamp:0x61DFF633 [Thu Jan 13 09:51:47 2022 UTC]
                                                                          TLS Callbacks:
                                                                          CLR (.Net) Version:v4.0.30319
                                                                          OS Version Major:4
                                                                          OS Version Minor:0
                                                                          File Version Major:4
                                                                          File Version Minor:0
                                                                          Subsystem Version Major:4
                                                                          Subsystem Version Minor:0
                                                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                          Entrypoint Preview

                                                                          Instruction
                                                                          jmp dword ptr [00402000h]
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al

                                                                          Data Directories

                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x8fcf00x4b.text
                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x900000x5e0.rsrc
                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x920000xc.reloc
                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                          Sections

                                                                          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                          .text0x20000x8dd440x8de00False0.806477147577data7.56350374002IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                          .rsrc0x900000x5e00x600False0.430338541667data4.17654103463IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                          .reloc0x920000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                          Resources

                                                                          NameRVASizeTypeLanguageCountry
                                                                          RT_VERSION0x900a00x354data
                                                                          RT_MANIFEST0x903f40x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                          Imports

                                                                          DLLImport
                                                                          mscoree.dll_CorExeMain

                                                                          Version Infos

                                                                          DescriptionData
                                                                          Translation0x0000 0x04b0
                                                                          LegalCopyrightVolcanologists R (C)
                                                                          Assembly Version1.4.0.0
                                                                          InternalNamePolicyLev.exe
                                                                          FileVersion1.4.0.0
                                                                          CompanyNameVolcanologists R
                                                                          LegalTrademarks
                                                                          Comments
                                                                          ProductNameTheBottomHalf
                                                                          ProductVersion1.4.0.0
                                                                          FileDescriptionTheBottomHalf
                                                                          OriginalFilenamePolicyLev.exe

                                                                          Network Behavior

                                                                          Network Port Distribution

                                                                          TCP Packets

                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Jan 13, 2022 20:55:37.716947079 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:37.779475927 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:37.779623985 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.030756950 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.031210899 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.093826056 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.093868971 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.094228029 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.156843901 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.208772898 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.215018034 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.278708935 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.278752089 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.278778076 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.278799057 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.278851032 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.278882027 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.341253996 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.404108047 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.458822012 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.686903000 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.749757051 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.751410007 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.815258980 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.816240072 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.891427040 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.892287016 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:38.962730885 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:38.963748932 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:39.031382084 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:39.031868935 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:39.094799042 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:39.096743107 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:39.097032070 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:39.097867012 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:39.098064899 CET49836587192.168.2.577.88.21.158
                                                                          Jan 13, 2022 20:55:39.160569906 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:39.160602093 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:39.415364027 CET5874983677.88.21.158192.168.2.5
                                                                          Jan 13, 2022 20:55:39.458869934 CET49836587192.168.2.577.88.21.158

                                                                          UDP Packets

                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Jan 13, 2022 20:55:37.569441080 CET5926153192.168.2.58.8.8.8
                                                                          Jan 13, 2022 20:55:37.586563110 CET53592618.8.8.8192.168.2.5
                                                                          Jan 13, 2022 20:55:37.599062920 CET5715153192.168.2.58.8.8.8
                                                                          Jan 13, 2022 20:55:37.617896080 CET53571518.8.8.8192.168.2.5

                                                                          DNS Queries

                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                          Jan 13, 2022 20:55:37.569441080 CET192.168.2.58.8.8.80xbf6cStandard query (0)smtp.yandex.comA (IP address)IN (0x0001)
                                                                          Jan 13, 2022 20:55:37.599062920 CET192.168.2.58.8.8.80x8386Standard query (0)smtp.yandex.comA (IP address)IN (0x0001)

                                                                          DNS Answers

                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                          Jan 13, 2022 20:55:37.586563110 CET8.8.8.8192.168.2.50xbf6cNo error (0)smtp.yandex.comsmtp.yandex.ruCNAME (Canonical name)IN (0x0001)
                                                                          Jan 13, 2022 20:55:37.586563110 CET8.8.8.8192.168.2.50xbf6cNo error (0)smtp.yandex.ru77.88.21.158A (IP address)IN (0x0001)
                                                                          Jan 13, 2022 20:55:37.617896080 CET8.8.8.8192.168.2.50x8386No error (0)smtp.yandex.comsmtp.yandex.ruCNAME (Canonical name)IN (0x0001)
                                                                          Jan 13, 2022 20:55:37.617896080 CET8.8.8.8192.168.2.50x8386No error (0)smtp.yandex.ru77.88.21.158A (IP address)IN (0x0001)

                                                                          SMTP Packets

                                                                          TimestampSource PortDest PortSource IPDest IPCommands
                                                                          Jan 13, 2022 20:55:38.030756950 CET5874983677.88.21.158192.168.2.5220 vla3-3dd1bd6927b2.qloud-c.yandex.net ESMTP (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1642103737-PXioOG3DVS-tbPOA4RV
                                                                          Jan 13, 2022 20:55:38.031210899 CET49836587192.168.2.577.88.21.158EHLO 992547
                                                                          Jan 13, 2022 20:55:38.093868971 CET5874983677.88.21.158192.168.2.5250-vla3-3dd1bd6927b2.qloud-c.yandex.net
                                                                          250-8BITMIME
                                                                          250-PIPELINING
                                                                          250-SIZE 53477376
                                                                          250-STARTTLS
                                                                          250-AUTH LOGIN PLAIN XOAUTH2
                                                                          250-DSN
                                                                          250 ENHANCEDSTATUSCODES
                                                                          Jan 13, 2022 20:55:38.094228029 CET49836587192.168.2.577.88.21.158STARTTLS
                                                                          Jan 13, 2022 20:55:38.156843901 CET5874983677.88.21.158192.168.2.5220 Go ahead

                                                                          Code Manipulations

                                                                          Statistics

                                                                          Behavior

                                                                          Click to jump to process

                                                                          System Behavior

                                                                          Analysis Process: V5Al4cc8RL.exe PID: 6220 Parent PID: 3020

                                                                          General

                                                                          Start time:20:53:43
                                                                          Start date:13/01/2022
                                                                          Path:C:\Users\user\Desktop\V5Al4cc8RL.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:"C:\Users\user\Desktop\V5Al4cc8RL.exe"
                                                                          Imagebase:0x760000
                                                                          File size:583680 bytes
                                                                          MD5 hash:5B8C247358C809A35EDFC69CE74EA5C7
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:.Net C# or VB.NET
                                                                          Yara matches:
                                                                          • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.257945194.0000000002B07000.00000004.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.257831013.0000000002A91000.00000004.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.258273747.0000000003A99000.00000004.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.258273747.0000000003A99000.00000004.00000001.sdmp, Author: Joe Security
                                                                          Reputation:low

                                                                          Analysis Process: V5Al4cc8RL.exe PID: 6512 Parent PID: 6220

                                                                          General

                                                                          Start time:20:53:53
                                                                          Start date:13/01/2022
                                                                          Path:C:\Users\user\Desktop\V5Al4cc8RL.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:C:\Users\user\Desktop\V5Al4cc8RL.exe
                                                                          Imagebase:0x680000
                                                                          File size:583680 bytes
                                                                          MD5 hash:5B8C247358C809A35EDFC69CE74EA5C7
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:.Net C# or VB.NET
                                                                          Yara matches:
                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.497968057.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.497968057.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.255852649.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.255852649.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.255239710.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.255239710.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.254686523.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.254686523.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.254143628.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.254143628.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.505859012.0000000002A61000.00000004.00000001.sdmp, Author: Joe Security
                                                                          Reputation:low

                                                                          Disassembly

                                                                          Code Analysis

                                                                          Reset < >