Edit tour

Windows Analysis Report
From Richard.exe

Overview

General Information

Sample Name:	From Richard.exe
Analysis ID:	626543
MD5:	fa530d1cf018a5cc8c8215344b09d2f7
SHA1:	bbd46bf5bead0b503ce045e5d5a856745bca49b9
SHA256:	fe581076f8a8cd90b93b2bca8fde7fa8008c2c1c0962fc0282f785354fcda4a4
Tags:	agentteslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

From Richard.exe (PID: 6432 cmdline: "C:\Users\user\Desktop\From Richard.exe" MD5: FA530D1CF018A5CC8C8215344B09D2F7)

From Richard.exe (PID: 6732 cmdline: C:\Users\user\Desktop\From Richard.exe MD5: FA530D1CF018A5CC8C8215344B09D2F7)

From Richard.exe (PID: 6740 cmdline: C:\Users\user\Desktop\From Richard.exe MD5: FA530D1CF018A5CC8C8215344B09D2F7)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "btc@imfalert.com", "Password": "dontgiveup@2022", "Host": "mail.imfalert.com"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000000.271694098.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000000.271694098.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000000.271208855.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000000.271208855.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000002.508749383.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.508749383.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000000.270510923.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000000.270510923.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000000.270879293.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000000.270879293.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.277272933.0000000003481000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.281354781.00000000045DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.281354781.00000000045DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: From Richard.exe PID: 6432	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: From Richard.exe PID: 6432	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: From Richard.exe PID: 6740	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: From Richard.exe PID: 6740	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.0.From Richard.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.0.From Richard.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
5.0.From Richard.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b21:$s10: logins 0x32588:$s11: credential 0x2eb72:$g1: get_Clipboard 0x2eb80:$g2: get_Keyboard 0x2eb8d:$g3: get_Password 0x2fe91:$g4: get_CtrlKeyDown 0x2fea1:$g5: get_ShiftKeyDown 0x2feb2:$g6: get_AltKeyDown
5.2.From Richard.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.From Richard.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
5.2.From Richard.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b21:$s10: logins 0x32588:$s11: credential 0x2eb72:$g1: get_Clipboard 0x2eb80:$g2: get_Keyboard 0x2eb8d:$g3: get_Password 0x2fe91:$g4: get_CtrlKeyDown 0x2fea1:$g5: get_ShiftKeyDown 0x2feb2:$g6: get_AltKeyDown
5.0.From Richard.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.0.From Richard.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
5.0.From Richard.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b21:$s10: logins 0x32588:$s11: credential 0x2eb72:$g1: get_Clipboard 0x2eb80:$g2: get_Keyboard 0x2eb8d:$g3: get_Password 0x2fe91:$g4: get_CtrlKeyDown 0x2fea1:$g5: get_ShiftKeyDown 0x2feb2:$g6: get_AltKeyDown
5.0.From Richard.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.0.From Richard.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
5.0.From Richard.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b21:$s10: logins 0x32588:$s11: credential 0x2eb72:$g1: get_Clipboard 0x2eb80:$g2: get_Keyboard 0x2eb8d:$g3: get_Password 0x2fe91:$g4: get_CtrlKeyDown 0x2fea1:$g5: get_ShiftKeyDown 0x2feb2:$g6: get_AltKeyDown
5.0.From Richard.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.0.From Richard.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
5.0.From Richard.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b21:$s10: logins 0x32588:$s11: credential 0x2eb72:$g1: get_Clipboard 0x2eb80:$g2: get_Keyboard 0x2eb8d:$g3: get_Password 0x2fe91:$g4: get_CtrlKeyDown 0x2fea1:$g5: get_ShiftKeyDown 0x2feb2:$g6: get_AltKeyDown
0.2.From Richard.exe.46b62b0.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.From Richard.exe.46b62b0.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.From Richard.exe.46b62b0.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d21:$s10: logins 0x30788:$s11: credential 0x2cd72:$g1: get_Clipboard 0x2cd80:$g2: get_Keyboard 0x2cd8d:$g3: get_Password 0x2e091:$g4: get_CtrlKeyDown 0x2e0a1:$g5: get_ShiftKeyDown 0x2e0b2:$g6: get_AltKeyDown
0.2.From Richard.exe.47058b0.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.From Richard.exe.47058b0.7.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.From Richard.exe.47058b0.7.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xb8541:$s10: logins 0xec961:$s10: logins 0xb7fa8:$s11: credential 0xec3c8:$s11: credential 0xb4592:$g1: get_Clipboard 0xe89b2:$g1: get_Clipboard 0xb45a0:$g2: get_Keyboard 0xe89c0:$g2: get_Keyboard 0xb45ad:$g3: get_Password 0xe89cd:$g3: get_Password 0xb58b1:$g4: get_CtrlKeyDown 0xe9cd1:$g4: get_CtrlKeyDown 0xb58c1:$g5: get_ShiftKeyDown 0xe9ce1:$g5: get_ShiftKeyDown 0xb58d2:$g6: get_AltKeyDown 0xe9cf2:$g6: get_AltKeyDown
0.2.From Richard.exe.47058b0.7.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x47f43:$s1: file:/// 0x47e53:$s2: {11111-22222-10009-11112} 0x47ed3:$s3: {11111-22222-50001-00000} 0x458fe:$s4: get_Module 0x45d6d:$s5: Reverse 0xb4b19:$s5: Reverse 0xe8f39:$s5: Reverse 0x47a27:$s6: BlockCopy 0xb69c7:$s6: BlockCopy 0xeade7:$s6: BlockCopy 0xb4dba:$s7: ReadByte 0xe91da:$s7: ReadByte 0x47f55:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
5.0.From Richard.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.0.From Richard.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
5.0.From Richard.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b21:$s10: logins 0x32588:$s11: credential 0x2eb72:$g1: get_Clipboard 0x2eb80:$g2: get_Keyboard 0x2eb8d:$g3: get_Password 0x2fe91:$g4: get_CtrlKeyDown 0x2fea1:$g5: get_ShiftKeyDown 0x2feb2:$g6: get_AltKeyDown
0.2.From Richard.exe.46b62b0.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.From Richard.exe.46b62b0.8.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.From Richard.exe.46b62b0.8.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b21:$s10: logins 0x107b41:$s10: logins 0x13bf61:$s10: logins 0x32588:$s11: credential 0x1075a8:$s11: credential 0x13b9c8:$s11: credential 0x2eb72:$g1: get_Clipboard 0x103b92:$g1: get_Clipboard 0x137fb2:$g1: get_Clipboard 0x2eb80:$g2: get_Keyboard 0x103ba0:$g2: get_Keyboard 0x137fc0:$g2: get_Keyboard 0x2eb8d:$g3: get_Password 0x103bad:$g3: get_Password 0x137fcd:$g3: get_Password 0x2fe91:$g4: get_CtrlKeyDown 0x104eb1:$g4: get_CtrlKeyDown 0x1392d1:$g4: get_CtrlKeyDown 0x2fea1:$g5: get_ShiftKeyDown 0x104ec1:$g5: get_ShiftKeyDown 0x1392e1:$g5: get_ShiftKeyDown
0.2.From Richard.exe.46b62b0.8.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x97543:$s1: file:/// 0x97453:$s2: {11111-22222-10009-11112} 0x974d3:$s3: {11111-22222-50001-00000} 0x94efe:$s4: get_Module 0x2f0f9:$s5: Reverse 0x9536d:$s5: Reverse 0x104119:$s5: Reverse 0x138539:$s5: Reverse 0x30fa7:$s6: BlockCopy 0x97027:$s6: BlockCopy 0x105fc7:$s6: BlockCopy 0x13a3e7:$s6: BlockCopy 0x2f39a:$s7: ReadByte 0x1043ba:$s7: ReadByte 0x1387da:$s7: ReadByte 0x97555:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.From Richard.exe.467fe90.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.From Richard.exe.467fe90.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.From Richard.exe.467fe90.6.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x68f41:$s10: logins 0x13df61:$s10: logins 0x172381:$s10: logins 0x689a8:$s11: credential 0x13d9c8:$s11: credential 0x171de8:$s11: credential 0x64f92:$g1: get_Clipboard 0x139fb2:$g1: get_Clipboard 0x16e3d2:$g1: get_Clipboard 0x64fa0:$g2: get_Keyboard 0x139fc0:$g2: get_Keyboard 0x16e3e0:$g2: get_Keyboard 0x64fad:$g3: get_Password 0x139fcd:$g3: get_Password 0x16e3ed:$g3: get_Password 0x662b1:$g4: get_CtrlKeyDown 0x13b2d1:$g4: get_CtrlKeyDown 0x16f6f1:$g4: get_CtrlKeyDown 0x662c1:$g5: get_ShiftKeyDown 0x13b2e1:$g5: get_ShiftKeyDown 0x16f701:$g5: get_ShiftKeyDown
0.2.From Richard.exe.467fe90.6.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0xcd963:$s1: file:/// 0xcd873:$s2: {11111-22222-10009-11112} 0xcd8f3:$s3: {11111-22222-50001-00000} 0xcb31e:$s4: get_Module 0x65519:$s5: Reverse 0xcb78d:$s5: Reverse 0x13a539:$s5: Reverse 0x16e959:$s5: Reverse 0x673c7:$s6: BlockCopy 0xcd447:$s6: BlockCopy 0x13c3e7:$s6: BlockCopy 0x170807:$s6: BlockCopy 0x657ba:$s7: ReadByte 0x13a7da:$s7: ReadByte 0x16ebfa:$s7: ReadByte 0xcd975:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.From Richard.exe.34dbc04.3.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.From Richard.exe.34dbc04.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x2489c2:$v1: SbieDll.dll 0x2489dc:$v2: USER 0x2489e8:$v3: SANDBOX 0x2489fa:$v4: VIRUS 0x248a4a:$v4: VIRUS 0x248a08:$v5: MALWARE 0x248a1a:$v6: SCHMIDTI 0x248a2e:$v7: CURRENTUSER
0.2.From Richard.exe.34e7e50.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.From Richard.exe.34e7e50.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x23c776:$v1: SbieDll.dll 0x23c790:$v2: USER 0x23c79c:$v3: SANDBOX 0x23c7ae:$v4: VIRUS 0x23c7fe:$v4: VIRUS 0x23c7bc:$v5: MALWARE 0x23c7ce:$v6: SCHMIDTI 0x23c7e2:$v7: CURRENTUSER
0.2.From Richard.exe.34d49b8.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.From Richard.exe.34d49b8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x24fc0e:$v1: SbieDll.dll 0x24fc28:$v2: USER 0x24fc34:$v3: SANDBOX 0x24fc46:$v4: VIRUS 0x24fc96:$v4: VIRUS 0x24fc54:$v5: MALWARE 0x24fc66:$v6: SCHMIDTI 0x24fc7a:$v7: CURRENTUSER
Click to see the 34 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5.0.From Richard.exe.400000.12.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "btc@imfalert.com", "Password": "dontgiveup@2022", "Host": "mail.imfalert.com"}

Multi AV Scanner detection for submitted file

Source: From Richard.exe	Virustotal: Detection: 49%			Perma Link
Source: From Richard.exe	ReversingLabs: Detection: 46%

Machine Learning detection for sample

Source: From Richard.exe

Joe Sandbox ML: detected

Source: 5.0.From Richard.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 5.2.From Richard.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 5.0.From Richard.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 5.0.From Richard.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 5.0.From Richard.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 5.0.From Richard.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8

Source: From Richard.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: From Richard.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Joe Sandbox View

ASN Name: 24SHELLSUS 24SHELLSUS

Source: global traffic

TCP traffic: 192.168.2.3:49747 -> 209.205.209.130:587

Source: global traffic

TCP traffic: 192.168.2.3:49747 -> 209.205.209.130:587

Source: From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: From Richard.exe, 00000005.00000002.510099135.000000000164A000.00000004.00000020.00020000.00000000.sdmp, From Richard.exe, 00000005.00000002.511136148.0000000003538000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000005.00000003.303178584.0000000001676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: From Richard.exe, 00000005.00000002.510099135.000000000164A000.00000004.00000020.00020000.00000000.sdmp, From Richard.exe, 00000005.00000003.303178584.0000000001676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: From Richard.exe, 00000005.00000002.510099135.000000000164A000.00000004.00000020.00020000.00000000.sdmp, From Richard.exe, 00000005.00000002.511136148.0000000003538000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000005.00000003.303178584.0000000001676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: From Richard.exe, 00000005.00000002.510099135.000000000164A000.00000004.00000020.00020000.00000000.sdmp, From Richard.exe, 00000005.00000002.511136148.0000000003538000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000005.00000003.303178584.0000000001676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: From Richard.exe, 00000005.00000002.511136148.0000000003538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://imfalert.com
Source: From Richard.exe, 00000005.00000002.511136148.0000000003538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.imfalert.com
Source: From Richard.exe, 00000005.00000002.510099135.000000000164A000.00000004.00000020.00020000.00000000.sdmp, From Richard.exe, 00000005.00000002.511136148.0000000003538000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000005.00000003.303178584.0000000001676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rfVwMD.com
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000003.248894766.00000000062E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: From Richard.exe, 00000000.00000002.281959651.00000000062D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: From Richard.exe, 00000000.00000002.281959651.00000000062D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coml1
Source: From Richard.exe, 00000000.00000002.281959651.00000000062D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: From Richard.exe, 00000000.00000003.256001459.000000000630E000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000003.256123470.000000000630E000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000003.256046813.000000000630E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmfr-fr
Source: From Richard.exe, 00000000.00000003.247889234.00000000062D6000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: From Richard.exe, 00000000.00000003.250902150.00000000062D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: From Richard.exe, 00000000.00000003.250902150.00000000062D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/-us;
Source: From Richard.exe, 00000000.00000003.250902150.00000000062D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/6
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: From Richard.exe, 00000000.00000003.247889234.00000000062D6000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: From Richard.exe, 00000000.00000003.247889234.00000000062D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr-
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000003.246948322.00000000062EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: From Richard.exe, 00000005.00000002.511306936.000000000355C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://GJvFKn8SY2mNH.org
Source: From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%
Source: From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%%startupfolder%
Source: From Richard.exe, 00000005.00000002.510099135.000000000164A000.00000004.00000020.00020000.00000000.sdmp, From Richard.exe, 00000005.00000002.511136148.0000000003538000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000005.00000003.303178584.0000000001676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

DNS traffic detected: queries for: mail.imfalert.com

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\From Richard.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\From Richard.exe

Source: From Richard.exe, 00000000.00000002.276043133.000000000170A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\From Richard.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.0.From Richard.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.2.From Richard.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.0.From Richard.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.0.From Richard.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.0.From Richard.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.From Richard.exe.46b62b0.8.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.From Richard.exe.47058b0.7.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.From Richard.exe.47058b0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 5.0.From Richard.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.From Richard.exe.46b62b0.8.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.From Richard.exe.46b62b0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.From Richard.exe.467fe90.6.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.From Richard.exe.467fe90.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.From Richard.exe.34dbc04.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.2.From Richard.exe.34e7e50.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.2.From Richard.exe.34d49b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen

.NET source code contains very large array initializations

Source: 5.0.From Richard.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007bF135A869u002dBA3Du002d45C8u002dAC34u002dEAAFFB741756u007d/u00336F4C64Fu002d1F76u002d4A10u002dB795u002d9BC0FAEEEC7B.cs	Large array initialization: .cctor: array initializer size 11616
Source: 5.2.From Richard.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bF135A869u002dBA3Du002d45C8u002dAC34u002dEAAFFB741756u007d/u00336F4C64Fu002d1F76u002d4A10u002dB795u002d9BC0FAEEEC7B.cs	Large array initialization: .cctor: array initializer size 11616
Source: 5.0.From Richard.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007bF135A869u002dBA3Du002d45C8u002dAC34u002dEAAFFB741756u007d/u00336F4C64Fu002d1F76u002d4A10u002dB795u002d9BC0FAEEEC7B.cs	Large array initialization: .cctor: array initializer size 11616
Source: 5.0.From Richard.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007bF135A869u002dBA3Du002d45C8u002dAC34u002dEAAFFB741756u007d/u00336F4C64Fu002d1F76u002d4A10u002dB795u002d9BC0FAEEEC7B.cs	Large array initialization: .cctor: array initializer size 11616

Source: From Richard.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 5.0.From Richard.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.2.From Richard.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.0.From Richard.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.0.From Richard.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.0.From Richard.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.From Richard.exe.46b62b0.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.From Richard.exe.47058b0.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.From Richard.exe.47058b0.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 5.0.From Richard.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.From Richard.exe.46b62b0.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.From Richard.exe.46b62b0.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.From Richard.exe.467fe90.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.From Richard.exe.467fe90.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.From Richard.exe.34dbc04.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.2.From Richard.exe.34e7e50.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.2.From Richard.exe.34d49b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window

Source: C:\Users\user\Desktop\From Richard.exe	Code function: 0_2_03461308
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 0_2_034612F8
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 0_2_03460950
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 0_2_07D7A3F0
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 0_2_07D702C8
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 0_2_07D702B8
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_0158F080
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_0158F3C8
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_01586120
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_063BBBD8
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_063BC928
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_063B8750
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_063B0040
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_063B1FF8
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F5E48
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068FCE48
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F7A28
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068FDA52
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068FDCC8
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F44F8
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F32A8

Source: C:\Users\user\Desktop\From Richard.exe

Code function: String function: 063B5A58 appears 54 times

Source: From Richard.exe	Binary or memory string: OriginalFilename vs From Richard.exe
Source: From Richard.exe, 00000000.00000002.282489980.0000000007CC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs From Richard.exe
Source: From Richard.exe, 00000000.00000002.277272933.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRMysppdAnaltxyBqYXEDchtfFaaYFjGe.exe4 vs From Richard.exe
Source: From Richard.exe, 00000000.00000002.276043133.000000000170A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs From Richard.exe
Source: From Richard.exe, 00000000.00000002.281354781.00000000045DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRMysppdAnaltxyBqYXEDchtfFaaYFjGe.exe4 vs From Richard.exe
Source: From Richard.exe, 00000000.00000002.281354781.00000000045DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs From Richard.exe
Source: From Richard.exe	Binary or memory string: OriginalFilename vs From Richard.exe
Source: From Richard.exe	Binary or memory string: OriginalFilename vs From Richard.exe
Source: From Richard.exe, 00000005.00000000.271694098.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRMysppdAnaltxyBqYXEDchtfFaaYFjGe.exe4 vs From Richard.exe
Source: From Richard.exe, 00000005.00000002.509928461.000000000159A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs From Richard.exe
Source: From Richard.exe, 00000005.00000002.509536424.00000000012F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs From Richard.exe
Source: From Richard.exe	Binary or memory string: OriginalFilenamePropertyBuil.exe8 vs From Richard.exe

Source: From Richard.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: From Richard.exe	Virustotal: Detection: 49%
Source: From Richard.exe	ReversingLabs: Detection: 46%

Source: From Richard.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\From Richard.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\From Richard.exe "C:\Users\user\Desktop\From Richard.exe"
Source: C:\Users\user\Desktop\From Richard.exe	Process created: C:\Users\user\Desktop\From Richard.exe C:\Users\user\Desktop\From Richard.exe
Source: C:\Users\user\Desktop\From Richard.exe	Process created: C:\Users\user\Desktop\From Richard.exe C:\Users\user\Desktop\From Richard.exe
Source: C:\Users\user\Desktop\From Richard.exe	Process created: C:\Users\user\Desktop\From Richard.exe C:\Users\user\Desktop\From Richard.exe
Source: C:\Users\user\Desktop\From Richard.exe	Process created: C:\Users\user\Desktop\From Richard.exe C:\Users\user\Desktop\From Richard.exe

Source: C:\Users\user\Desktop\From Richard.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Source: C:\Users\user\Desktop\From Richard.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\From Richard.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\From Richard.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\From Richard.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@2/1

Source: C:\Users\user\Desktop\From Richard.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\From Richard.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: 5.0.From Richard.exe.400000.12.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.0.From Richard.exe.400000.12.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.From Richard.exe.400000.0.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.From Richard.exe.400000.0.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.0.From Richard.exe.400000.8.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.0.From Richard.exe.400000.8.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\From Richard.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\From Richard.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\From Richard.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\From Richard.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\From Richard.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: From Richard.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: From Richard.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: From Richard.exe, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 0.0.From Richard.exe.fc0000.0.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 0.2.From Richard.exe.fc0000.0.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 4.0.From Richard.exe.340000.3.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 4.0.From Richard.exe.340000.0.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 4.0.From Richard.exe.340000.2.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 4.0.From Richard.exe.340000.1.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 4.2.From Richard.exe.340000.0.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 5.0.From Richard.exe.ec0000.7.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 5.0.From Richard.exe.ec0000.0.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 5.0.From Richard.exe.ec0000.13.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 5.0.From Richard.exe.ec0000.2.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 5.0.From Richard.exe.ec0000.1.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 5.0.From Richard.exe.ec0000.3.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 5.0.From Richard.exe.ec0000.9.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 5.2.From Richard.exe.ec0000.1.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)
Source: 5.0.From Richard.exe.ec0000.11.unpack, Main.cs	.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "5370617273656C79506F70756C617465644172", "33523545", "TexasHoldem" } }, null, null)

Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F178F push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F1783 push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F179B push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F17A1 push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F17B9 push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F17D1 push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F17EB push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F177B push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F25DD push E9017AD0h; retn 0006h
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F2520 push edi; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F32A8 push es; iretd
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F32A8 push es; iretd
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F40B1 push es; iretd
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F18DD push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F181B push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F1817 push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F1827 push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F1833 push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F1867 push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F187F push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F1873 push es; ret
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F41D9 push es; iretd
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F41D1 push es; iretd
Source: C:\Users\user\Desktop\From Richard.exe	Code function: 5_2_068F2177 push edi; retn 0000h

Source: initial sample

Static PE information: section name: .text entropy: 7.90632247255

Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\From Richard.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.From Richard.exe.34dbc04.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.From Richard.exe.34e7e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.From Richard.exe.34d49b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.277272933.0000000003481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: From Richard.exe PID: 6432, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: From Richard.exe, 00000000.00000002.277272933.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: From Richard.exe, 00000000.00000002.277272933.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\From Richard.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\From Richard.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\From Richard.exe TID: 6436	Thread sleep time: -45733s >= -30000s
Source: C:\Users\user\Desktop\From Richard.exe TID: 6904	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Users\user\Desktop\From Richard.exe TID: 6920	Thread sleep count: 4317 > 30
Source: C:\Users\user\Desktop\From Richard.exe TID: 6920	Thread sleep count: 4754 > 30

Source: C:\Users\user\Desktop\From Richard.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\From Richard.exe	Window / User API: threadDelayed 4317
Source: C:\Users\user\Desktop\From Richard.exe	Window / User API: threadDelayed 4754

Source: C:\Users\user\Desktop\From Richard.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\From Richard.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\From Richard.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\From Richard.exe	Thread delayed: delay time: 45733
Source: C:\Users\user\Desktop\From Richard.exe	Thread delayed: delay time: 922337203685477

Source: From Richard.exe, 00000000.00000002.277272933.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: From Richard.exe, 00000000.00000002.277272933.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: From Richard.exe, 00000000.00000002.277272933.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: From Richard.exe, 00000005.00000002.510099135.000000000164A000.00000004.00000020.00020000.00000000.sdmp, From Richard.exe, 00000005.00000003.303178584.0000000001676000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: From Richard.exe, 00000000.00000002.277272933.0000000003481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\From Richard.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\From Richard.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\From Richard.exe

Code function: 5_2_063BFA48 LdrInitializeThunk,

Source: C:\Users\user\Desktop\From Richard.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\From Richard.exe	Process created: C:\Users\user\Desktop\From Richard.exe C:\Users\user\Desktop\From Richard.exe
Source: C:\Users\user\Desktop\From Richard.exe	Process created: C:\Users\user\Desktop\From Richard.exe C:\Users\user\Desktop\From Richard.exe

Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Users\user\Desktop\From Richard.exe VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Users\user\Desktop\From Richard.exe VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\From Richard.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\From Richard.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 5.0.From Richard.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.From Richard.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.From Richard.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.From Richard.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.From Richard.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.From Richard.exe.46b62b0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.From Richard.exe.47058b0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.From Richard.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.From Richard.exe.46b62b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.From Richard.exe.467fe90.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.271694098.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.271208855.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.508749383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.270510923.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.270879293.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.281354781.00000000045DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: From Richard.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: From Richard.exe PID: 6740, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\From Richard.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Desktop\From Richard.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Desktop\From Richard.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Desktop\From Richard.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\From Richard.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\From Richard.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
Source: C:\Users\user\Desktop\From Richard.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\From Richard.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\Desktop\From Richard.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: Yara match	File source: 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: From Richard.exe PID: 6740, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 5.0.From Richard.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.From Richard.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.From Richard.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.From Richard.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.From Richard.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.From Richard.exe.46b62b0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.From Richard.exe.47058b0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.From Richard.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.From Richard.exe.46b62b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.From Richard.exe.467fe90.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.271694098.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.271208855.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.508749383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.270510923.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.270879293.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.281354781.00000000045DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: From Richard.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: From Richard.exe PID: 6740, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	2 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	111 Input Capture	1 Process Discovery	Remote Desktop Protocol	111 Input Capture	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	1 Credentials in Registry	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	Scheduled Transfer	11 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	1 Clipboard Data	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Obfuscated Files or Information	Cached Domain Credentials	114 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	13 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
From Richard.exe	49%	Virustotal		Browse
From Richard.exe	46%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
From Richard.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
5.0.From Richard.exe.400000.12.unpack	100%	Avira	TR/Spy.Gen8	Download File
5.2.From Richard.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
5.0.From Richard.exe.400000.8.unpack	100%	Avira	TR/Spy.Gen8	Download File
5.0.From Richard.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File
5.0.From Richard.exe.400000.10.unpack	100%	Avira	TR/Spy.Gen8	Download File
5.0.From Richard.exe.400000.6.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
imfalert.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	URL Reputation	safe
http://www.sandoll.co.kr-	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
https://api.ipify.org%%startupfolder%	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/6	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coml1	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/-us;	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://imfalert.com	0%	Avira URL Cloud	safe
http://mail.imfalert.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://rfVwMD.com	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htmfr-fr	0%	Avira URL Cloud	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
https://GJvFKn8SY2mNH.org	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://api.ipify.org%	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
imfalert.com	209.205.209.130	true	true	0%, Virustotal, Browse	unknown
mail.imfalert.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000003.248894766.00000000062E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	From Richard.exe, 00000005.00000002.510099135.000000000164A000.00000004.00000020.00020000.00000000.sdmp, From Richard.exe, 00000005.00000002.511136148.0000000003538000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000005.00000003.303178584.0000000001676000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr-	From Richard.exe, 00000000.00000003.247889234.00000000062D6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.tiro.com	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000003.246948322.00000000062EB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org%%startupfolder%	From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://www.goodfont.co.kr	From Richard.exe, 00000000.00000003.247889234.00000000062D6000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/6	From Richard.exe, 00000000.00000003.250902150.00000000062D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.coma	From Richard.exe, 00000000.00000002.281959651.00000000062D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.coml1	From Richard.exe, 00000000.00000002.281959651.00000000062D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/-us;	From Richard.exe, 00000000.00000003.250902150.00000000062D2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://imfalert.com	From Richard.exe, 00000005.00000002.511136148.0000000003538000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.imfalert.com	From Richard.exe, 00000005.00000002.511136148.0000000003538000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://rfVwMD.com	From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htmfr-fr	From Richard.exe, 00000000.00000003.256001459.000000000630E000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000003.256123470.000000000630E000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000003.256046813.000000000630E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comm	From Richard.exe, 00000000.00000002.281959651.00000000062D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	From Richard.exe, 00000000.00000003.250902150.00000000062D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	From Richard.exe, 00000000.00000003.247889234.00000000062D6000.00000004.00000800.00020000.00000000.sdmp, From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://GJvFKn8SY2mNH.org	From Richard.exe, 00000005.00000002.511306936.000000000355C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	From Richard.exe, 00000000.00000002.282112351.00000000074E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%	From Richard.exe, 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
209.205.209.130	imfalert.com	United States		55081	24SHELLSUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626543
Start date and time: 14/05/202211:57:10	2022-05-14 11:57:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 43s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	From Richard.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@2/1
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 0.1% (good quality ratio 0%) Quality average: 33.6% Quality standard deviation: 27.4%
HCA Information:	Successful, ratio: 97% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, settings-win.data.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target From Richard.exe, PID 6732 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:58:18	API Interceptor	725x Sleep call for process: From Richard.exe modified

Process:	C:\Users\user\Desktop\From Richard.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.345811588615766
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4FsXE8:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHJ
MD5:	EA78C102145ED608EF0E407B978AF339
SHA1:	66C9179ED9675B9271A97AB1FC878077E09AB731
SHA-256:	8BF01E0C445BD07C0B4EDC7199B7E17DAF1CA55CA52D4A6EAC4EF211C2B1A73E
SHA-512:	8C04139A1FC3C3BDACB680EC443615A43EB18E73B5A0CFCA644CB4A5E71746B275B3E238DD1A5A205405313E457BB75F9BBB93277C67AFA5D78DCFA30E5DA02B
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.897267979651854
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	From Richard.exe
File size:	550912
MD5:	fa530d1cf018a5cc8c8215344b09d2f7
SHA1:	bbd46bf5bead0b503ce045e5d5a856745bca49b9
SHA256:	fe581076f8a8cd90b93b2bca8fde7fa8008c2c1c0962fc0282f785354fcda4a4
SHA512:	1ca23c746e0f98a384e2bc0842c773af9bb9bcac2c2bc2d2b38ebc870f0ea49466957fb1d0661fe5f7ecc3169857e9b250960eed9d222e9612b6f4d5818ffb7f
SSDEEP:	12288:IhWQ1JN/HRCakerytvcHi9sS2Q7oY4J/DP:UWQ1JpRCs20Hid2Qob9
TLSH:	0BC4122932F47B66E8BB9BFC42B4300503F5662B3111F3AE9DC520DB6A65F540741EAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....}b..............0..^...........}... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x487d82
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x627DCBA3 [Fri May 13 03:08:19 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x87d30	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x5c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x85d88	0x85e00	False	0.930996877918	data	7.90632247255	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x88000	0x5c4	0x600	False	0.424479166667	data	4.122031579	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8a000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x88090	0x334	data
RT_MANIFEST	0x883d4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2017
Assembly Version	1.0.0.0
InternalName	PropertyBuil.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	TexasHoldem
ProductVersion	1.0.0.0
FileDescription	TexasHoldem
OriginalFilename	PropertyBuil.exe

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 11:58:36.338269949 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:36.441176891 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:36.441324949 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:36.595638990 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:36.598819971 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:36.702187061 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:36.702584982 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:36.807768106 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:36.865362883 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:36.974081039 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:36.974169016 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:36.974215984 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:36.974255085 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:36.974255085 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:36.974313021 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:36.975522995 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:37.028873920 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:37.132056952 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:37.225039959 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:37.328228951 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:37.332756996 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:37.436261892 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:37.469553947 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:37.588709116 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:37.606544971 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:37.709552050 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:37.712232113 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:37.825894117 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:37.876655102 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:37.979805946 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:37.981095076 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:37.981161118 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:37.981924057 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:37.982029915 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 11:58:38.084068060 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:38.084152937 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:38.084671021 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:38.084703922 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:38.093137980 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 11:58:38.136451006 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 12:00:15.973247051 CEST	49747	587	192.168.2.3	209.205.209.130
May 14, 2022 12:00:16.117870092 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 12:00:16.405720949 CEST	587	49747	209.205.209.130	192.168.2.3
May 14, 2022 12:00:16.407898903 CEST	49747	587	192.168.2.3	209.205.209.130

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 11:58:36.054285049 CEST	55923	53	192.168.2.3	8.8.8.8
May 14, 2022 11:58:36.157443047 CEST	53	55923	8.8.8.8	192.168.2.3
May 14, 2022 11:58:36.216921091 CEST	57723	53	192.168.2.3	8.8.8.8
May 14, 2022 11:58:36.318223953 CEST	53	57723	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 14, 2022 11:58:36.054285049 CEST	192.168.2.3	8.8.8.8	0x7825	Standard query (0)	mail.imfalert.com	A (IP address)	IN (0x0001)
May 14, 2022 11:58:36.216921091 CEST	192.168.2.3	8.8.8.8	0x7190	Standard query (0)	mail.imfalert.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 14, 2022 11:58:36.157443047 CEST	8.8.8.8	192.168.2.3	0x7825	No error (0)	mail.imfalert.com	imfalert.com		CNAME (Canonical name)	IN (0x0001)
May 14, 2022 11:58:36.157443047 CEST	8.8.8.8	192.168.2.3	0x7825	No error (0)	imfalert.com		209.205.209.130	A (IP address)	IN (0x0001)
May 14, 2022 11:58:36.318223953 CEST	8.8.8.8	192.168.2.3	0x7190	No error (0)	mail.imfalert.com	imfalert.com		CNAME (Canonical name)	IN (0x0001)
May 14, 2022 11:58:36.318223953 CEST	8.8.8.8	192.168.2.3	0x7190	No error (0)	imfalert.com		209.205.209.130	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 14, 2022 11:58:36.595638990 CEST	587	49747	209.205.209.130	192.168.2.3	220-standard8.doveserver.com ESMTP Exim 4.95 #2 Sat, 14 May 2022 10:58:36 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 14, 2022 11:58:36.598819971 CEST	49747	587	192.168.2.3	209.205.209.130	EHLO 585948
May 14, 2022 11:58:36.702187061 CEST	587	49747	209.205.209.130	192.168.2.3	250-standard8.doveserver.com Hello 585948 [102.129.143.55] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-STARTTLS 250 HELP
May 14, 2022 11:58:36.702584982 CEST	49747	587	192.168.2.3	209.205.209.130	STARTTLS
May 14, 2022 11:58:36.807768106 CEST	587	49747	209.205.209.130	192.168.2.3	220 TLS go ahead

Target ID:	0
Start time:	11:58:10
Start date:	14/05/2022
Path:	C:\Users\user\Desktop\From Richard.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\From Richard.exe"
Imagebase:	0xfc0000
File size:	550912 bytes
MD5 hash:	FA530D1CF018A5CC8C8215344B09D2F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.277272933.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.281354781.00000000045DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.281354781.00000000045DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: From Richard.exePID: 6732, Parent PID: 6432

General

Target ID:	4
Start time:	11:58:20
Start date:	14/05/2022
Path:	C:\Users\user\Desktop\From Richard.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\From Richard.exe
Imagebase:	0x340000
File size:	550912 bytes
MD5 hash:	FA530D1CF018A5CC8C8215344B09D2F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: From Richard.exePID: 6740, Parent PID: 6432

General

Target ID:	5
Start time:	11:58:22
Start date:	14/05/2022
Path:	C:\Users\user\Desktop\From Richard.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\From Richard.exe
Imagebase:	0xec0000
File size:	550912 bytes
MD5 hash:	FA530D1CF018A5CC8C8215344B09D2F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000000.271694098.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000000.271694098.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000000.271208855.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000000.271208855.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.508749383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000002.508749383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000000.270510923.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000000.270510923.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000000.270879293.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000000.270879293.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.510323471.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report From Richard.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\From Richard.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Windows Analysis Report
From Richard.exe

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre