Windows Analysis Report
SecuriteInfo.com.Variant.Strictor.272734.30355.11938

Overview

General Information

Sample Name: SecuriteInfo.com.Variant.Strictor.272734.30355.11938 (renamed file extension from 11938 to exe)
Analysis ID: 632534
MD5: f7b5a24637b27abfd5809a27997ea31d
SHA1: 7230e7f3bcb4e57d73fedf3c0d85067e95761323
SHA256: ced900f9ec05901373c3ae09a06b3ef5ef958764f1fc551590b5f2a820f115a1
Tags: exeFormbook
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Found malware configuration
Source: 00000000.00000002.280007107.0000000003E51000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.gulabmonga.com/gfge/"], "decoy": ["loopcoalition.com", "hd126.com", "elioguion.net", "defitrader.academy", "exactemi.com", "angeloacierno.com", "range4tis.com", "ilovekuduro.us", "mydealsstation.com", "jerichoprinting.com", "birdcafe605.com", "freemansrepublic.com", "driedplasma.com", "valuableconnect.com", "anthonyvid.xyz", "theydo.support", "devnetsecops.com", "cryptork.tech", "ufheur678.store", "lavenderspa586.com", "scandicinvestmentholding.com", "youenfangtex.com", "gratefulgrandmas.com", "ampersandtalent.net", "wippychick.com", "stamping.digital", "trixes.net", "popinticket.com", "ivyleaguereading.com", "killerinktnpasumo3.xyz", "greatyuwx.com", "royaltortoisecookieco.online", "quinten-and-sam.com", "mobile-sh.com", "reacjs.com", "hongbufang.net", "winemenuimports.com", "nashuatelegrpah.com", "nicorgaa.com", "outlanfd.com", "personalitideal.com", "mhhj666.com", "themethodcollective.com", "36536a.com", "bijit.xyz", "yoursinsoccer.net", "cryptoducks.club", "defuw.com", "kangley.net", "hacvm.com", "zhouyihong.top", "takut5.com", "kreditnekarticers.com", "koigo-wp.com", "52byhx.com", "phaghpanah.com", "apqlds.com", "karxsba2ix.xyz", "demasinfimo.quest", "unitytrstbnk.com", "panasonic-hcm.com", "27530amethystway.com", "idealftz.xyz", "conventionline.com"]}
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe ReversingLabs: Detection: 41%
Yara detected FormBook
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3e51c08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.280007107.0000000003E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.280674228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.274944732.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.276081424.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Avira: detected
Antivirus detection for URL or domain
Source: www.gulabmonga.com/gfge/ Avira URL Cloud: Label: malware
Machine Learning detection for sample
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Uses 32bit PE files
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000003.279519488.0000000000E26000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000002.282777820.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000003.277122320.0000000000C8F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000002.283522610.00000000010DF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000003.279519488.0000000000E26000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000002.282777820.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000003.277122320.0000000000C8F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000002.283522610.00000000010DF000.00000040.00000800.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4x nop then pop edi 4_2_0040C3D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4x nop then pop edi 4_2_00415652

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.gulabmonga.com/gfge/
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.283550225.0000000006EF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3e51c08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.280007107.0000000003E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.280674228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.274944732.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.276081424.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3e51c08.7.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3e51c08.7.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.7630000.11.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.3.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3ebe1e0.0.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.3.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3f46e00.1.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.7630000.11.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.3.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3f46e00.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.2d453e8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.2d457f4.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.2d46000.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.3.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3ebe1e0.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000000.00000002.280007107.0000000003E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.280007107.0000000003E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.284504751.0000000007630000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000004.00000002.280674228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.280674228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.274944732.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.274944732.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.276081424.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.276081424.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3e51c08.7.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3e51c08.7.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.7630000.11.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.3.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3ebe1e0.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.3.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3f46e00.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.7630000.11.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.3.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3f46e00.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.2d453e8.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.2d457f4.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.2d46000.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.3.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3ebe1e0.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000000.00000002.280007107.0000000003E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.280007107.0000000003E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.284504751.0000000007630000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000004.00000002.280674228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.280674228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.274944732.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.274944732.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.276081424.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.276081424.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 0_2_0132E778 0_2_0132E778
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 0_2_0132E768 0_2_0132E768
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_00401030 4_2_00401030
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0041BA9D 4_2_0041BA9D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0041CB90 4_2_0041CB90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_00408C6B 4_2_00408C6B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_00408C70 4_2_00408C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_00402D87 4_2_00402D87
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_00402D90 4_2_00402D90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_00402FB0 4_2_00402FB0
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_004185D0 NtCreateFile, 4_2_004185D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_00418680 NtReadFile, 4_2_00418680
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_00418700 NtClose, 4_2_00418700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_004187B0 NtAllocateVirtualMemory, 4_2_004187B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_004186FA NtClose, 4_2_004186FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_004187AA NtAllocateVirtualMemory, 4_2_004187AA
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Binary or memory string: OriginalFilename vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.278113921.0000000000972000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCOMServerEn.exeF vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.284504751.0000000007630000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameIVectorView.dllN vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000003.268214252.0000000003D53000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameIVectorView.dllN vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Binary or memory string: OriginalFilename vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000003.279929044.0000000000F45000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000000.272909693.00000000005B2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCOMServerEn.exeF vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000002.284160709.000000000126F000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000002.283522610.00000000010DF000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000003.277427240.0000000000DA5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Binary or memory string: OriginalFilenameCOMServerEn.exeF vs SecuriteInfo.com.Variant.Strictor.272734.30355.exe
PE file contains strange resources
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe ReversingLabs: Detection: 41%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe:Zone.Identifier Jump to behavior
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Variant.Strictor.272734.30355.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@3/1@0/0
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Mutant created: \Sessions\1\BaseNamedObjects\GQUPSYLANzmrKS
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000003.279519488.0000000000E26000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000002.282777820.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000003.277122320.0000000000C8F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000002.283522610.00000000010DF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000003.279519488.0000000000E26000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000002.282777820.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000003.277122320.0000000000C8F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000004.00000002.283522610.00000000010DF000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, MainForm.cs .Net Code: DateTime System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.970000.0.unpack, MainForm.cs .Net Code: DateTime System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.970000.0.unpack, MainForm.cs .Net Code: DateTime System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.5b0000.7.unpack, MainForm.cs .Net Code: DateTime System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.5b0000.1.unpack, MainForm.cs .Net Code: DateTime System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.5b0000.5.unpack, MainForm.cs .Net Code: DateTime System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.5b0000.1.unpack, MainForm.cs .Net Code: DateTime System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.5b0000.0.unpack, MainForm.cs .Net Code: DateTime System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.5b0000.9.unpack, MainForm.cs .Net Code: DateTime System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.5b0000.3.unpack, MainForm.cs .Net Code: DateTime System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 0_2_0132E298 push 2402B6C3h; ret 0_2_0132E2A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 0_2_0132F550 push eax; retf 0_2_0132F551
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 0_2_0132F5F2 pushfd ; retf 0_2_0132F5F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0041B87C push eax; ret 4_2_0041B882
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0041B812 push eax; ret 4_2_0041B818
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0041B81B push eax; ret 4_2_0041B882
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0040C8D2 push esp; iretd 4_2_0040C8DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0041C905 push dword ptr [DE3B1691h]; ret 4_2_0041C926
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0041612A push 78D33A13h; iretd 4_2_004161E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_004161B3 push 78D33A13h; iretd 4_2_004161E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0040C2F8 push ds; retf 4_2_0040C328
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0040D417 push 00000060h; iretd 4_2_0040D41D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0041CDA5 push 073A5053h; ret 4_2_0041CDC5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_00414E92 push esp; ret 4_2_00414EA1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_00414EA2 push ds; retf 4_2_00414EA3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_0041B7C5 push eax; ret 4_2_0041B818
Source: initial sample Static PE information: section name: .text entropy: 7.98237673455
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.2d453e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.2d457f4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.2d46000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.279126660.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.279186212.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Strictor.272734.30355.exe PID: 4812, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.279126660.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.279186212.0000000002D40000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.279126660.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.279186212.0000000002D40000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe RDTSC instruction interceptor: First address: 0000000000408604 second address: 000000000040860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe TID: 3032 Thread sleep time: -43731s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe TID: 1960 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_004088C0 rdtsc 4_2_004088C0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Thread delayed: delay time: 43731 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.279186212.0000000002D40000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.279186212.0000000002D40000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.279186212.0000000002D40000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.Variant.Strictor.272734.30355.exe, 00000000.00000002.279186212.0000000002D40000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Code function: 4_2_004088C0 rdtsc 4_2_004088C0
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process token adjusted: Debug Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Strictor.272734.30355.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3e51c08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.280007107.0000000003E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.280674228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.274944732.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.276081424.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.3e51c08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.SecuriteInfo.com.Variant.Strictor.272734.30355.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.280007107.0000000003E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.280674228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.274944732.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.276081424.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 632534 Sample: SecuriteInfo.com.Variant.St... Startdate: 23/05/2022 Architecture: WINDOWS Score: 100 14 Found malware configuration 2->14 16 Malicious sample detected (through community Yara rule) 2->16 18 Antivirus detection for URL or domain 2->18 20 8 other signatures 2->20 6 SecuriteInfo.com.Variant.Strictor.272734.30355.exe 3 2->6         started        process3 file4 12 SecuriteInfo.com.V...72734.30355.exe.log, ASCII 6->12 dropped 22 Tries to detect virtualization through RDTSC time measurements 6->22 24 Injects a PE file into a foreign processes 6->24 10 SecuriteInfo.com.Variant.Strictor.272734.30355.exe 6->10         started        signatures5 process6
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.gulabmonga.com/gfge/ true
  • Avira URL Cloud: malware
 low