Windows Analysis Report
22o5gJzlg6.exe

Overview

General Information

Sample Name: 22o5gJzlg6.exe
Analysis ID: 679116
MD5: 1f85c12fcd3232c577e5e8cc07fbf1e1
SHA1: 3741755f8a11638209821a3cd7c01104acac184d
SHA256: f229ed07a73bf6f353a8429a9842aeb6c2e35a47f3b353bce93cca550efbbee4
Tags: exenjratRAT
Infos:

Detection

Njrat
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Njrat
Snort IDS alert for network traffic
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Uses 32bit PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
Sample file is different than original file name gathered from version info
PE file contains strange resources
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 22o5gJzlg6.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: 22o5gJzlg6.exe Virustotal: Detection: 73% Perma Link
Source: 22o5gJzlg6.exe Metadefender: Detection: 42% Perma Link
Source: 22o5gJzlg6.exe ReversingLabs: Detection: 69%
Yara detected Njrat
Source: Yara match File source: Process Memory Space: 22o5gJzlg6.exe PID: 5776, type: MEMORYSTR
Machine Learning detection for sample
Source: 22o5gJzlg6.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 0.0.22o5gJzlg6.exe.430000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen
Source: 0.2.22o5gJzlg6.exe.27abcb4.0.raw.unpack Malware Configuration Extractor: Njrat {"Host": "milla11.publicvm.com", "Port": "5050", "Mutex Name": "d84c416188f84fa099", "Network Seprator": "@!#&^%$", "Campaign ID": "NYAN CAT", "Version": "0.7NC"}
Uses 32bit PE files
Source: 22o5gJzlg6.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49765 -> 91.109.186.4:5050
Source: Traffic Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49765 -> 91.109.186.4:5050
Source: Traffic Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49765 -> 91.109.186.4:5050
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: milla11.publicvm.com
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49765 -> 91.109.186.4:5050
Source: 22o5gJzlg6.exe, 00000000.00000003.427915980.0000000005806000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://en.w
Source: 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.428170416.0000000005806000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: 22o5gJzlg6.exe, 00000000.00000003.428170416.0000000005806000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com-e
Source: 22o5gJzlg6.exe, 00000000.00000003.428170416.0000000005806000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.comx
Source: 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 22o5gJzlg6.exe, 00000000.00000003.435183566.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435226866.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435352161.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435154857.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435564805.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435393505.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435434677.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435275521.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html~
Source: 22o5gJzlg6.exe, 00000000.00000003.432863626.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432436607.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432261621.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432675327.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432828022.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432499311.000000000580F000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432899886.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432630198.000000000580F000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.433019323.000000000580F000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432759453.000000000580F000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432283139.000000000580F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: 22o5gJzlg6.exe, 00000000.00000003.432436607.0000000005811000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com1
Source: 22o5gJzlg6.exe, 00000000.00000003.433244896.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432997847.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com8
Source: 22o5gJzlg6.exe, 00000000.00000003.432863626.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.433296887.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.433244896.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432997847.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.433420738.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comC~
Source: 22o5gJzlg6.exe, 00000000.00000003.432997847.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comE
Source: 22o5gJzlg6.exe, 00000000.00000003.433296887.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.433244896.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432997847.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.433420738.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coma
Source: 22o5gJzlg6.exe, 00000000.00000003.432261621.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coma-d
Source: 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: 22o5gJzlg6.exe, 00000000.00000003.432675327.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432828022.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432630198.000000000580F000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432759453.000000000580F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.como.
Source: 22o5gJzlg6.exe, 00000000.00000003.432499311.000000000580F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comva
Source: 22o5gJzlg6.exe, 00000000.00000003.432863626.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.433244896.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432997847.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com~
Source: 22o5gJzlg6.exe, 00000000.00000003.439066250.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440146087.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.437770989.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438952936.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438683013.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440822748.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439187961.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440351183.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438563728.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440850654.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440448532.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438892084.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438487330.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438225069.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439221383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440257383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438377965.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438456044.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440546293.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440646134.0000000005812000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 22o5gJzlg6.exe, 00000000.00000003.438782064.00000000057F0000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438763045.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: 22o5gJzlg6.exe, 00000000.00000003.439609629.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439519748.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439279849.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com4
Source: 22o5gJzlg6.exe, 00000000.00000003.437693822.000000000580E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: 22o5gJzlg6.exe, 00000000.00000003.439066250.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438952936.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438892084.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438763045.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comT.TTF=
Source: 22o5gJzlg6.exe, 00000000.00000003.437693822.000000000580E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comTTF
Source: 22o5gJzlg6.exe, 00000000.00000003.437851582.000000000580E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: 22o5gJzlg6.exe, 00000000.00000003.440146087.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439609629.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440351183.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440448532.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439642692.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440257383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440546293.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440646134.0000000005812000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comals
Source: 22o5gJzlg6.exe, 00000000.00000003.440146087.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440822748.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439609629.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440351183.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440850654.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440448532.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439642692.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440257383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440546293.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440646134.0000000005812000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd
Source: 22o5gJzlg6.exe, 00000000.00000003.438683013.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438563728.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438487330.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438225069.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438377965.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438456044.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438174770.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438763045.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd_
Source: 22o5gJzlg6.exe, 00000000.00000003.439066250.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438952936.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438683013.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439187961.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439519748.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438563728.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438892084.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438487330.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439221383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438377965.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438456044.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439416035.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438763045.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439279849.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comessed
Source: 22o5gJzlg6.exe, 00000000.00000003.439066250.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438952936.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438683013.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439187961.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438563728.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438892084.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438487330.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438225069.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439221383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438377965.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438456044.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438174770.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438763045.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439279849.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comessedI
Source: 22o5gJzlg6.exe, 00000000.00000003.440146087.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440822748.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439609629.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440351183.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439519748.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440850654.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440448532.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439642692.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440257383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440546293.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440646134.0000000005812000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comitu_
Source: 22o5gJzlg6.exe, 00000000.00000003.439066250.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438952936.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439187961.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438892084.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439221383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439279849.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: 22o5gJzlg6.exe, 00000000.00000003.440822748.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440351183.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440850654.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440448532.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440257383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440546293.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440646134.0000000005812000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comrsiv&
Source: 22o5gJzlg6.exe, 00000000.00000003.440146087.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440822748.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440351183.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440850654.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440448532.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440257383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440546293.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.440646134.0000000005812000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comsiefl
Source: 22o5gJzlg6.exe, 00000000.00000002.699727274.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.446329043.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.446126364.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.446267888.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.446363357.0000000005810000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comt
Source: 22o5gJzlg6.exe, 00000000.00000003.439066250.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438952936.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438683013.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439187961.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438563728.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438892084.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438487330.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438225069.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439221383.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438377965.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438456044.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.438763045.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.439279849.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comtt
Source: 22o5gJzlg6.exe, 00000000.00000002.699727274.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.446329043.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.446126364.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.446267888.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.446363357.0000000005810000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comuea
Source: 22o5gJzlg6.exe, 00000000.00000003.437851582.000000000580E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comz
Source: 22o5gJzlg6.exe, 00000000.00000003.427915980.0000000005806000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: 22o5gJzlg6.exe, 00000000.00000003.431016693.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.431510900.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: 22o5gJzlg6.exe, 00000000.00000003.431386511.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.431226577.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.431719100.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.431510900.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: 22o5gJzlg6.exe, 00000000.00000003.430476742.0000000005806000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.430516625.0000000005806000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/;
Source: 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 22o5gJzlg6.exe, 00000000.00000003.431148925.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.431016693.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnC
Source: 22o5gJzlg6.exe, 00000000.00000003.430863609.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnCTI
Source: 22o5gJzlg6.exe, 00000000.00000003.431386511.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.431226577.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.431148925.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.431016693.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.431510900.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnQ
Source: 22o5gJzlg6.exe, 00000000.00000003.430863609.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnRIN
Source: 22o5gJzlg6.exe, 00000000.00000003.430863609.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnTFu
Source: 22o5gJzlg6.exe, 00000000.00000003.442920288.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.442005981.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.442520590.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.443542427.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.442655517.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.443031431.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.442962847.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.442741235.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.443220777.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.442128327.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.443153111.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.443450897.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.443332430.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 22o5gJzlg6.exe, 00000000.00000003.442520590.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.442128327.0000000005812000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/l
Source: 22o5gJzlg6.exe, 00000000.00000003.442056543.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.442655517.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.442501394.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 22o5gJzlg6.exe, 00000000.00000003.430244973.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: 22o5gJzlg6.exe, 00000000.00000003.434381509.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 22o5gJzlg6.exe, 00000000.00000003.435442221.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.436179663.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435183566.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434705101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435226866.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435352161.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435154857.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435573925.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435635608.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434965433.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434616172.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434929567.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.436098101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435840977.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.436041454.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435402188.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435275521.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/&
Source: 22o5gJzlg6.exe, 00000000.00000003.434705101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434616172.0000000005810000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/(
Source: 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: 22o5gJzlg6.exe, 00000000.00000003.434060485.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434492066.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434026409.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434381509.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/4
Source: 22o5gJzlg6.exe, 00000000.00000003.434060485.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435183566.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435226866.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435154857.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434965433.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434026409.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434929567.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435275521.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/=
Source: 22o5gJzlg6.exe, 00000000.00000003.434705101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434965433.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434616172.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434929567.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/V
Source: 22o5gJzlg6.exe, 00000000.00000003.434705101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434492066.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434965433.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434616172.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434929567.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/X
Source: 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435402188.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435275521.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434381509.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: 22o5gJzlg6.exe, 00000000.00000003.434705101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434492066.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434616172.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/iv
Source: 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.436098101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435840977.000000000580E000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.436041454.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435402188.0000000005812000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435275521.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: 22o5gJzlg6.exe, 00000000.00000003.434705101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434965433.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434616172.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434929567.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/4
Source: 22o5gJzlg6.exe, 00000000.00000003.434705101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434492066.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434616172.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434381509.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/=
Source: 22o5gJzlg6.exe, 00000000.00000003.434060485.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434026409.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434381509.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/kurs
Source: 22o5gJzlg6.exe, 00000000.00000003.435183566.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434705101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435226866.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435154857.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434965433.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434929567.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435275521.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/l
Source: 22o5gJzlg6.exe, 00000000.00000003.435183566.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434705101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435226866.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435154857.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434492066.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434965433.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434616172.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434929567.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435275521.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/r
Source: 22o5gJzlg6.exe, 00000000.00000003.435183566.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434705101.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435226866.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435154857.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434492066.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434965433.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434616172.0000000005810000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434929567.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434860772.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435275521.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.434381509.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/sv-s
Source: 22o5gJzlg6.exe, 00000000.00000003.445348164.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.445413832.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.441424361.00000000057EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.
Source: 22o5gJzlg6.exe, 00000000.00000003.443332430.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.Y
Source: 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: 22o5gJzlg6.exe, 00000000.00000003.435143246.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.435173659.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com8
Source: 22o5gJzlg6.exe, 00000000.00000003.430432412.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.430522948.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.430486289.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.430185630.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.430244973.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.430578626.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: 22o5gJzlg6.exe, 00000000.00000003.430432412.000000000580D000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.430486289.000000000580D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kra
Source: 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: 22o5gJzlg6.exe, 00000000.00000002.700212667.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: 22o5gJzlg6.exe, 00000000.00000002.699831067.00000000069F2000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432261621.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432071419.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: 22o5gJzlg6.exe, 00000000.00000003.432071419.0000000005808000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn.i
Source: 22o5gJzlg6.exe, 00000000.00000003.432436607.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432071419.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432499311.000000000580F000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432283139.000000000580F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cno.
Source: 22o5gJzlg6.exe, 00000000.00000003.432436607.0000000005811000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432071419.0000000005808000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000003.432283139.000000000580F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnva
Source: unknown DNS traffic detected: queries for: milla11.publicvm.com

E-Banking Fraud
barindex
Yara detected Njrat
Source: Yara match File source: Process Memory Space: 22o5gJzlg6.exe PID: 5776, type: MEMORYSTR
Uses 32bit PE files
Source: 22o5gJzlg6.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Sample file is different than original file name gathered from version info
Source: 22o5gJzlg6.exe, 00000000.00000002.696319010.0000000002761000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenametojen.exe4 vs 22o5gJzlg6.exe
Source: 22o5gJzlg6.exe, 00000000.00000000.423127249.00000000004C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameGoogle webmaster.exeD vs 22o5gJzlg6.exe
Source: 22o5gJzlg6.exe Binary or memory string: OriginalFilenameGoogle webmaster.exeD vs 22o5gJzlg6.exe
PE file contains strange resources
Source: 22o5gJzlg6.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Detected potential crypto function
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Code function: 0_2_00E2D030 0_2_00E2D030
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Code function: 0_2_07291270 0_2_07291270
Source: 22o5gJzlg6.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 22o5gJzlg6.exe Virustotal: Detection: 73%
Source: 22o5gJzlg6.exe Metadefender: Detection: 42%
Source: 22o5gJzlg6.exe ReversingLabs: Detection: 69%
Source: 22o5gJzlg6.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 22o5gJzlg6.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Mutant created: \Sessions\1\BaseNamedObjects\d84c416188f84fa099
Source: classification engine Classification label: mal80.troj.winEXE@1/0@1/1
Source: C:\Users\user\Desktop\22o5gJzlg6.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: 22o5gJzlg6.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Code function: 0_2_00E2274F push ds; iretd 0_2_00E2275A
Source: initial sample Static PE information: section name: .text entropy: 7.472442868082026
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Window / User API: threadDelayed 4996 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\22o5gJzlg6.exe TID: 4916 Thread sleep count: 4996 > 30 Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Memory allocated: page read and write | page guard Jump to behavior
Source: 22o5gJzlg6.exe, 00000000.00000002.697124211.00000000027E2000.00000004.00000800.00020000.00000000.sdmp, 22o5gJzlg6.exe, 00000000.00000002.696802851.00000000027B3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Users\user\Desktop\22o5gJzlg6.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\22o5gJzlg6.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Njrat
Source: Yara match File source: Process Memory Space: 22o5gJzlg6.exe PID: 5776, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Njrat
Source: Yara match File source: Process Memory Space: 22o5gJzlg6.exe PID: 5776, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 679116 Sample: 22o5gJzlg6.exe Startdate: 05/08/2022 Architecture: WINDOWS Score: 80 10 Snort IDS alert for network traffic 2->10 12 Antivirus / Scanner detection for submitted sample 2->12 14 Multi AV Scanner detection for submitted file 2->14 16 3 other signatures 2->16 5 22o5gJzlg6.exe 2 2 2->5         started        process3 dnsIp4 8 milla11.publicvm.com 91.109.186.4, 49765, 5050 IELOIELOMainNetworkFR France 5->8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.109.186.4
 milla11.publicvm.com France
29075 IELOIELOMainNetworkFR false

Contacted Domains

Name IP Active
milla11.publicvm.com 91.109.186.4 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
milla11.publicvm.com false
    		high