Windows Analysis Report
Updated statement.exe

Overview

General Information

Sample Name: Updated statement.exe
Analysis ID: 562440
MD5: ffde62febd6a85f3ecdd24d4fc1fbefc
SHA1: 0c0bd6bbd865fff8e9983e51d9b4097857684a0e
SHA256: f8e99e2c7fab3cca06ccb78a7db5d2bfedd2bbcab16ff80a304b606e271cc9c8
Tags: AgentTeslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Telegram RAT
Yara detected AgentTesla
Yara detected AntiVM3
Multi AV Scanner detection for dropped file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses the Telegram API (likely for C&C communication)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains method to dynamically call methods (often used by packers)
Machine Learning detection for dropped file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Sigma detected: Autorun Keys Modification

Classification

AV Detection
barindex
Found malware configuration
Source: 19.0.YZtXgX.exe.400000.4.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Chat id": "1625897843", "Chat URL": "https://api.telegram.org/bot1641777799:AAHdp3u4L6fVtZntWVtNfV4UJrnCJ4wHmD4/sendDocument"}
Source: YZtXgX.exe.4104.16.memstrmin Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot1641777799:AAHdp3u4L6fVtZntWVtNfV4UJrnCJ4wHmD4/sendMessage"}
Multi AV Scanner detection for submitted file
Source: Updated statement.exe ReversingLabs: Detection: 53%
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe ReversingLabs: Detection: 53%
Machine Learning detection for sample
Source: Updated statement.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 19.0.YZtXgX.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 19.0.YZtXgX.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 19.0.YZtXgX.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 5.0.Updated statement.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 19.0.YZtXgX.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 19.0.YZtXgX.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 5.0.Updated statement.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 19.2.YZtXgX.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 5.0.Updated statement.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 5.2.Updated statement.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 5.0.Updated statement.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 5.0.Updated statement.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8

Compliance
barindex
Uses 32bit PE files
Source: Updated statement.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: Updated statement.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: XMLUt.pdb source: YZtXgX.exe, Updated statement.exe, YZtXgX.exe.5.dr
Source: Binary string: XMLUt.pdb8 source: Updated statement.exe, YZtXgX.exe.5.dr

Networking
barindex
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Source: Updated statement.exe, 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: YZtXgX.exe, 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: YZtXgX.exe, 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://RCEHNd.com
Source: Updated statement.exe, 00000005.00000002.573910185.000000000306F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: Updated statement.exe, 00000000.00000002.354295687.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000010.00000002.473055712.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000012.00000002.481738036.00000000030E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://blog.iandreev.com
Source: Updated statement.exe, 00000000.00000002.354295687.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000010.00000002.473055712.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000012.00000002.481738036.00000000030E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://blog.iandreev.com/
Source: Updated statement.exe, 00000005.00000002.571302685.0000000001145000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Updated statement.exe, 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fPY8LulZKfW7HU.com
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: Updated statement.exe, 00000005.00000002.573864316.000000000305C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Updated statement.exe, 00000000.00000002.357595295.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Updated statement.exe, 00000005.00000002.573864316.000000000305C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: Updated statement.exe, 00000000.00000002.354763980.0000000003F49000.00000004.00000800.00020000.00000000.sdmp, Updated statement.exe, 00000005.00000002.569248859.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Updated statement.exe, 00000005.00000000.348571008.0000000000402000.00000040.00000400.00020000.00000000.sdmp, YZtXgX.exe, 00000010.00000002.476782330.00000000035E9000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000012.00000002.482645057.00000000040E9000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000013.00000000.466365050.0000000000402000.00000040.00000400.00020000.00000000.sdmp, YZtXgX.exe, 00000013.00000000.464085154.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot1641777799:AAHdp3u4L6fVtZntWVtNfV4UJrnCJ4wHmD4/
Source: Updated statement.exe, 00000005.00000002.573864316.000000000305C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot1641777799:AAHdp3u4L6fVtZntWVtNfV4UJrnCJ4wHmD4/sendDocument
Source: Updated statement.exe, 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot1641777799:AAHdp3u4L6fVtZntWVtNfV4UJrnCJ4wHmD4/sendDocumentdocument-----
Source: Updated statement.exe, 00000005.00000002.573864316.000000000305C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org4zl
Source: Updated statement.exe, 00000000.00000002.354763980.0000000003F49000.00000004.00000800.00020000.00000000.sdmp, Updated statement.exe, 00000005.00000002.569248859.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Updated statement.exe, 00000005.00000000.348571008.0000000000402000.00000040.00000400.00020000.00000000.sdmp, YZtXgX.exe, 00000010.00000002.476782330.00000000035E9000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000012.00000002.482645057.00000000040E9000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000013.00000000.466365050.0000000000402000.00000040.00000400.00020000.00000000.sdmp, YZtXgX.exe, 00000013.00000000.464085154.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Updated statement.exe, 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown DNS traffic detected: queries for: api.telegram.org

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: YZtXgX.exe, 00000010.00000002.470019848.0000000000948000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.Updated statement.exe.3fa29f0.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.0.YZtXgX.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.0.YZtXgX.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.0.Updated statement.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.0.YZtXgX.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 16.2.YZtXgX.exe.36429f0.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.0.YZtXgX.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.0.Updated statement.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.0.YZtXgX.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.2.YZtXgX.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.0.Updated statement.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Updated statement.exe.3fd8810.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.0.Updated statement.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.2.Updated statement.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 16.2.YZtXgX.exe.262d988.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.2.Updated statement.exe.2f8d9c4.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 18.2.YZtXgX.exe.41429f0.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 18.2.YZtXgX.exe.4178810.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 16.2.YZtXgX.exe.3678810.5.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.0.Updated statement.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Updated statement.exe.300d318.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 18.2.YZtXgX.exe.312d988.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 16.2.YZtXgX.exe.26ad1fc.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 18.2.YZtXgX.exe.31ad1fc.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 18.2.YZtXgX.exe.4178810.3.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 18.2.YZtXgX.exe.41429f0.4.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Updated statement.exe.3fa29f0.3.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 16.2.YZtXgX.exe.3678810.5.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Updated statement.exe.3fd8810.4.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 16.2.YZtXgX.exe.36429f0.4.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: Updated statement.exe PID: 3572, type: MEMORYSTR Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: YZtXgX.exe PID: 5424, type: MEMORYSTR Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Uses 32bit PE files
Source: Updated statement.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 0.2.Updated statement.exe.3fa29f0.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.0.YZtXgX.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.0.YZtXgX.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.0.Updated statement.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.0.YZtXgX.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 16.2.YZtXgX.exe.36429f0.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.0.YZtXgX.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.0.Updated statement.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.0.YZtXgX.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.2.YZtXgX.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.0.Updated statement.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Updated statement.exe.3fd8810.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.0.Updated statement.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.2.Updated statement.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 16.2.YZtXgX.exe.262d988.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.2.Updated statement.exe.2f8d9c4.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 18.2.YZtXgX.exe.41429f0.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 18.2.YZtXgX.exe.4178810.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 16.2.YZtXgX.exe.3678810.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.0.Updated statement.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Updated statement.exe.300d318.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 18.2.YZtXgX.exe.312d988.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 16.2.YZtXgX.exe.26ad1fc.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 18.2.YZtXgX.exe.31ad1fc.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 18.2.YZtXgX.exe.4178810.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 18.2.YZtXgX.exe.41429f0.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Updated statement.exe.3fa29f0.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 16.2.YZtXgX.exe.3678810.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Updated statement.exe.3fd8810.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 16.2.YZtXgX.exe.36429f0.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: Updated statement.exe PID: 3572, type: MEMORYSTR Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: YZtXgX.exe PID: 5424, type: MEMORYSTR Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Detected potential crypto function
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 0_2_07EF0040 0_2_07EF0040
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 0_2_07EF0006 0_2_07EF0006
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 5_2_02C947A0 5_2_02C947A0
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 5_2_02C946BA 5_2_02C946BA
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 5_2_02C9D5E1 5_2_02C9D5E1
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 5_2_06036508 5_2_06036508
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 5_2_060390D8 5_2_060390D8
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 5_2_06037120 5_2_06037120
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 5_2_06036850 5_2_06036850
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 5_2_0603E1D0 5_2_0603E1D0
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 16_2_00BE893A 16_2_00BE893A
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 16_2_00BE753C 16_2_00BE753C
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 16_2_00BE7540 16_2_00BE7540
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 16_2_06900007 16_2_06900007
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 16_2_06900040 16_2_06900040
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_02F8893A 18_2_02F8893A
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_02F874FF 18_2_02F874FF
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_02F87540 18_2_02F87540
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_02F8752F 18_2_02F8752F
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_057062D4 18_2_057062D4
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_05707090 18_2_05707090
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_05705230 18_2_05705230
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_0570323C 18_2_0570323C
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_05705220 18_2_05705220
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_0572C640 18_2_0572C640
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_0572C630 18_2_0572C630
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_0572A061 18_2_0572A061
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_0572A068 18_2_0572A068
Sample file is different than original file name gathered from version info
Source: Updated statement.exe, 00000000.00000000.300327958.0000000000A64000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameXMLUt.exe4 vs Updated statement.exe
Source: Updated statement.exe, 00000000.00000002.354385817.0000000002FF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs Updated statement.exe
Source: Updated statement.exe, 00000000.00000002.354763980.0000000003F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUbsrnlUhufyMhCoKtcXULDIZ.exe4 vs Updated statement.exe
Source: Updated statement.exe, 00000000.00000002.354763980.0000000003F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs Updated statement.exe
Source: Updated statement.exe, 00000000.00000002.358157906.0000000007DB0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs Updated statement.exe
Source: Updated statement.exe, 00000000.00000002.354295687.0000000002F41000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs Updated statement.exe
Source: Updated statement.exe, 00000000.00000002.354295687.0000000002F41000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs Updated statement.exe
Source: Updated statement.exe, 00000000.00000002.354295687.0000000002F41000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUbsrnlUhufyMhCoKtcXULDIZ.exe4 vs Updated statement.exe
Source: Updated statement.exe, 00000000.00000002.354345273.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameXMLUt.exe4 vs Updated statement.exe
Source: Updated statement.exe, 00000000.00000002.354345273.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs Updated statement.exe
Source: Updated statement.exe, 00000000.00000002.354345273.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hm,\\StringFileInfo\\000004B0\\OriginalFilename vs Updated statement.exe
Source: Updated statement.exe, 00000005.00000002.576116399.0000000006500000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameXMLUt.exe4 vs Updated statement.exe
Source: Updated statement.exe, 00000005.00000002.570990287.00000000010C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Updated statement.exe
Source: Updated statement.exe, 00000005.00000002.569918123.0000000000984000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameXMLUt.exe4 vs Updated statement.exe
Source: Updated statement.exe, 00000005.00000002.569248859.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUbsrnlUhufyMhCoKtcXULDIZ.exe4 vs Updated statement.exe
Source: Updated statement.exe Binary or memory string: OriginalFilenameXMLUt.exe4 vs Updated statement.exe
Source: Updated statement.exe ReversingLabs: Detection: 53%
Source: C:\Users\user\Desktop\Updated statement.exe File read: C:\Users\user\Desktop\Updated statement.exe:Zone.Identifier Jump to behavior
Source: Updated statement.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Updated statement.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Updated statement.exe "C:\Users\user\Desktop\Updated statement.exe"
Source: C:\Users\user\Desktop\Updated statement.exe Process created: C:\Users\user\Desktop\Updated statement.exe C:\Users\user\Desktop\Updated statement.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe "C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe "C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe"
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process created: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process created: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe
Source: C:\Users\user\Desktop\Updated statement.exe Process created: C:\Users\user\Desktop\Updated statement.exe C:\Users\user\Desktop\Updated statement.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process created: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process created: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Updated statement.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Updated statement.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@9/4@1/0
Source: C:\Users\user\Desktop\Updated statement.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: Updated statement.exe, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: Updated statement.exe, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.Updated statement.exe.990000.0.unpack, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.Updated statement.exe.990000.0.unpack, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Updated statement.exe.990000.0.unpack, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Updated statement.exe.990000.0.unpack, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: YZtXgX.exe.5.dr, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: YZtXgX.exe.5.dr, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.Updated statement.exe.8b0000.13.unpack, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.Updated statement.exe.8b0000.13.unpack, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.Updated statement.exe.8b0000.1.unpack, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.Updated statement.exe.8b0000.1.unpack, Gz/uu.cs Cryptographic APIs: 'CreateDecryptor'
Source: C:\Users\user\Desktop\Updated statement.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Updated statement.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Updated statement.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Updated statement.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: XMLUt.pdb source: YZtXgX.exe, Updated statement.exe, YZtXgX.exe.5.dr
Source: Binary string: XMLUt.pdb8 source: Updated statement.exe, YZtXgX.exe.5.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Updated statement.exe, Ut/S1.cs .Net Code: svd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.Updated statement.exe.990000.0.unpack, Ut/S1.cs .Net Code: svd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.Updated statement.exe.990000.0.unpack, Ut/S1.cs .Net Code: svd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: YZtXgX.exe.5.dr, Ut/S1.cs .Net Code: svd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.Updated statement.exe.8b0000.13.unpack, Ut/S1.cs .Net Code: svd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.Updated statement.exe.8b0000.1.unpack, Ut/S1.cs .Net Code: svd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
.NET source code contains method to dynamically call methods (often used by packers)
Source: Updated statement.exe, Gz/uu.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.Updated statement.exe.990000.0.unpack, Gz/uu.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.Updated statement.exe.990000.0.unpack, Gz/uu.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: YZtXgX.exe.5.dr, Gz/uu.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 5.0.Updated statement.exe.8b0000.13.unpack, Gz/uu.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 5.0.Updated statement.exe.8b0000.1.unpack, Gz/uu.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 0_2_07EFC0D5 push FFFFFF8Bh; iretd 0_2_07EFC0D7
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 5_2_06037AE8 push 8BF04589h; iretd 5_2_06037B74
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 16_2_06905799 push es; iretd 16_2_069057B4
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 16_2_0690575D push es; iretd 16_2_06905774
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 16_2_0690554F push es; ret 16_2_06905608
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 16_2_0690C0D5 push FFFFFF8Bh; iretd 16_2_0690C0D7
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 16_2_0690585D push es; ret 16_2_06905890
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_057033E8 push 04418B05h; ret 18_2_05706083
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_05706C60 push 20418B05h; ret 18_2_05706CD3
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_05706CE0 push 0C418B05h; ret 18_2_05706D53
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Code function: 18_2_057279B0 push ecx; ret 18_2_057279C5

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Users\user\Desktop\Updated statement.exe File created: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Jump to dropped file
Source: C:\Users\user\Desktop\Updated statement.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run YZtXgX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run YZtXgX Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\Updated statement.exe File opened: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 16.2.YZtXgX.exe.262d988.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Updated statement.exe.2f8d9c4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Updated statement.exe.300d318.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.YZtXgX.exe.312d988.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.YZtXgX.exe.26ad1fc.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.YZtXgX.exe.31ad1fc.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.354385817.0000000002FF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.354295687.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.474038972.0000000002699000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.473055712.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.481922581.0000000003199000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.481738036.00000000030E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Updated statement.exe PID: 6000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 4104, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 4960, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Updated statement.exe, 00000000.00000002.354385817.0000000002FF9000.00000004.00000800.00020000.00000000.sdmp, Updated statement.exe, 00000000.00000002.354295687.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000010.00000002.474038972.0000000002699000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000010.00000002.473055712.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000012.00000002.481922581.0000000003199000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000012.00000002.481738036.00000000030E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: Updated statement.exe, 00000000.00000002.354385817.0000000002FF9000.00000004.00000800.00020000.00000000.sdmp, Updated statement.exe, 00000000.00000002.354295687.0000000002F41000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000010.00000002.474038972.0000000002699000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000010.00000002.473055712.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000012.00000002.481922581.0000000003199000.00000004.00000800.00020000.00000000.sdmp, YZtXgX.exe, 00000012.00000002.481738036.00000000030E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Updated statement.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Updated statement.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Updated statement.exe TID: 6056 Thread sleep time: -33474s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe TID: 2528 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe TID: 7056 Thread sleep time: -21213755684765971s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe TID: 7024 Thread sleep count: 2794 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe TID: 7024 Thread sleep count: 7057 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe TID: 7008 Thread sleep time: -36513s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe TID: 3460 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe TID: 5716 Thread sleep time: -37134s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe TID: 5344 Thread sleep time: -23058430092136925s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe TID: 5380 Thread sleep count: 2830 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe TID: 5380 Thread sleep count: 7004 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Updated statement.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Updated statement.exe Window / User API: threadDelayed 2794 Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Window / User API: threadDelayed 7057 Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Window / User API: threadDelayed 2830 Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Window / User API: threadDelayed 7004 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Updated statement.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Updated statement.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Thread delayed: delay time: 33474 Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Thread delayed: delay time: 36513 Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Thread delayed: delay time: 37134 Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: YZtXgX.exe, 00000012.00000002.481738036.00000000030E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: YZtXgX.exe, 00000012.00000002.481738036.00000000030E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: YZtXgX.exe, 00000012.00000002.481738036.00000000030E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: Updated statement.exe, 00000005.00000002.571302685.0000000001145000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: YZtXgX.exe, 00000012.00000002.481738036.00000000030E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging
barindex
Enables debug privileges
Source: C:\Users\user\Desktop\Updated statement.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Updated statement.exe Memory written: C:\Users\user\Desktop\Updated statement.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Memory written: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Updated statement.exe Process created: C:\Users\user\Desktop\Updated statement.exe C:\Users\user\Desktop\Updated statement.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process created: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Process created: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Jump to behavior

Language, Device and Operating System Detection
barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Users\user\Desktop\Updated statement.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Users\user\Desktop\Updated statement.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\YZtXgX\YZtXgX.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\Updated statement.exe Code function: 5_2_06035594 GetUserNameW, 5_2_06035594

Stealing of Sensitive Information
barindex
Yara detected Telegram RAT
Source: Yara match File source: 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Updated statement.exe PID: 6000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Updated statement.exe PID: 3572, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 4104, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 4960, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 5424, type: MEMORYSTR
Yara detected AgentTesla
Source: Yara match File source: 0.2.Updated statement.exe.3fa29f0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.YZtXgX.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.YZtXgX.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Updated statement.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.YZtXgX.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.YZtXgX.exe.36429f0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.YZtXgX.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Updated statement.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.YZtXgX.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.YZtXgX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Updated statement.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Updated statement.exe.3fd8810.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Updated statement.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Updated statement.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.YZtXgX.exe.41429f0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.YZtXgX.exe.4178810.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.YZtXgX.exe.3678810.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Updated statement.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.YZtXgX.exe.4178810.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.YZtXgX.exe.41429f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Updated statement.exe.3fa29f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.YZtXgX.exe.3678810.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Updated statement.exe.3fd8810.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.YZtXgX.exe.36429f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000000.466365050.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.569248859.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.349300984.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.348571008.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.465782036.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.350482544.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.464085154.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.464873246.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.569250233.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.349871186.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.354763980.0000000003F49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.482645057.00000000040E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.476782330.00000000035E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Updated statement.exe PID: 6000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Updated statement.exe PID: 3572, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 4104, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 4960, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 5424, type: MEMORYSTR
Yara detected Credential Stealer
Source: Yara match File source: 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Updated statement.exe PID: 3572, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 5424, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Telegram RAT
Source: Yara match File source: 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Updated statement.exe PID: 6000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Updated statement.exe PID: 3572, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 4104, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 4960, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 5424, type: MEMORYSTR
Yara detected AgentTesla
Source: Yara match File source: 0.2.Updated statement.exe.3fa29f0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.YZtXgX.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.YZtXgX.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Updated statement.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.YZtXgX.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.YZtXgX.exe.36429f0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.YZtXgX.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Updated statement.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.YZtXgX.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.YZtXgX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Updated statement.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Updated statement.exe.3fd8810.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Updated statement.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Updated statement.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.YZtXgX.exe.41429f0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.YZtXgX.exe.4178810.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.YZtXgX.exe.3678810.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.Updated statement.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.YZtXgX.exe.4178810.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.YZtXgX.exe.41429f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Updated statement.exe.3fa29f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.YZtXgX.exe.3678810.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Updated statement.exe.3fd8810.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.YZtXgX.exe.36429f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000000.466365050.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.569248859.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.349300984.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.348571008.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.465782036.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.350482544.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.464085154.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.464873246.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.569250233.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.349871186.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.354763980.0000000003F49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.482645057.00000000040E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.476782330.00000000035E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.571806351.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.572235708.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Updated statement.exe PID: 6000, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Updated statement.exe PID: 3572, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 4104, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 4960, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: YZtXgX.exe PID: 5424, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 562440 Sample: Updated statement.exe Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 29 api.telegram.org 2->29 33 Found malware configuration 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 10 other signatures 2->39 7 YZtXgX.exe 3 2->7         started        10 Updated statement.exe 3 2->10         started        13 YZtXgX.exe 2 2->13         started        signatures3 process4 file5 41 Multi AV Scanner detection for dropped file 7->41 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->43 45 Machine Learning detection for dropped file 7->45 47 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->47 15 YZtXgX.exe 2 7->15         started        27 C:\Users\user\...\Updated statement.exe.log, ASCII 10->27 dropped 49 Injects a PE file into a foreign processes 10->49 17 Updated statement.exe 2 5 10->17         started        21 YZtXgX.exe 13->21         started        signatures6 process7 file8 23 C:\Users\user\AppData\Roaming\...\YZtXgX.exe, PE32 17->23 dropped 25 C:\Users\user\...\YZtXgX.exe:Zone.Identifier, ASCII 17->25 dropped 31 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->31 signatures9
⊘No contacted IP infos

Contacted Domains

Name IP Active
api.telegram.org 149.154.167.220 true