Windows Analysis Report
STAMPED CONTRACT.exe

Overview

General Information

Sample Name: STAMPED CONTRACT.exe
Analysis ID: 680576
MD5: 38e7f1ea9b24aa0ce2a81f0b8d1211f1
SHA1: ddf48946be08c406807d790f3577f9cfcef3b648
SHA256: 828a71aade93b8276b3c751172ef243ab79aeb6713849992ea5bcfe64d745a9f
Tags: agentteslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Injects a PE file into a foreign processes
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
.NET source code contains very large strings
Machine Learning detection for dropped file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Drops PE files
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: STAMPED CONTRACT.exe Virustotal: Detection: 40% Perma Link
Machine Learning detection for sample
Source: STAMPED CONTRACT.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\UBkncV.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "fombbsr@hindusthan.com", "Password": "f1o2m3", "Host": "mail.hindusthan.com"}
Uses 32bit PE files
Source: STAMPED CONTRACT.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: STAMPED CONTRACT.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_07BC4398
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_07BC444C
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_07BC4388

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49741 -> 192.185.46.31:587
Source: Traffic Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49741 -> 192.185.46.31:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49741 -> 192.185.46.31:587
Source: Traffic Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.3:49741 -> 192.185.46.31:587
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 192.185.46.31 192.185.46.31
Source: STAMPED CONTRACT.exe, 00000007.00000002.510347221.00000000030F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: STAMPED CONTRACT.exe, 00000007.00000002.510347221.00000000030F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: STAMPED CONTRACT.exe, 00000007.00000002.515912584.0000000003440000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://hindusthan.com
Source: STAMPED CONTRACT.exe, 00000007.00000002.515912584.0000000003440000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.hindusthan.com
Source: STAMPED CONTRACT.exe, 00000007.00000002.510347221.00000000030F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://rHDoBI.com
Source: STAMPED CONTRACT.exe, 00000000.00000002.272424508.0000000002891000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.241504634.0000000005833000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: STAMPED CONTRACT.exe, 00000000.00000003.243020613.0000000005832000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html;Y
Source: STAMPED CONTRACT.exe, 00000000.00000003.241837648.00000000057F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.come
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: STAMPED CONTRACT.exe, 00000000.00000003.241837648.00000000057F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comypo
Source: STAMPED CONTRACT.exe, 00000000.00000003.246095684.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246244019.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246138159.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246778015.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246634857.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246513766.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244387066.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244456429.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246462744.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244839521.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244590841.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244716470.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244871311.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246055786.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246613407.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245874099.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244410342.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246592558.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245982334.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244216645.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000002.272165959.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: STAMPED CONTRACT.exe, 00000000.00000003.245653439.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245629944.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245692605.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245601973.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245408934.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245566177.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: STAMPED CONTRACT.exe, 00000000.00000003.245601973.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245408934.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245566177.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlx
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244871311.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244898992.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: STAMPED CONTRACT.exe, 00000000.00000003.244871311.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244898992.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlht
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: STAMPED CONTRACT.exe, 00000000.00000003.245339211.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245184653.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245313803.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244839521.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244716470.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244871311.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244774460.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244664517.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244945073.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244981444.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244685393.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245236568.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245088265.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244744770.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244642233.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244898992.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245207412.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244621285.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comENN
Source: STAMPED CONTRACT.exe, 00000000.00000003.244216645.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244246168.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF2N
Source: STAMPED CONTRACT.exe, 00000000.00000003.246095684.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246244019.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246138159.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245733889.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246055786.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245653439.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245874099.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245982334.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245629944.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245915875.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245692605.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246184367.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245601973.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246309772.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246278619.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245804289.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comFsN
Source: STAMPED CONTRACT.exe, 00000000.00000003.245408934.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comNNA
Source: STAMPED CONTRACT.exe, 00000000.00000003.245487340.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245339211.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245184653.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245733889.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245373781.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245313803.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244839521.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244590841.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244716470.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244871311.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245653439.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244774460.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244503756.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244664517.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244945073.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245629944.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244981444.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245692605.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245601973.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244685393.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245408934.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comaNr
Source: STAMPED CONTRACT.exe, 00000000.00000003.244160565.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comcea5
Source: STAMPED CONTRACT.exe, 00000000.00000003.246095684.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246244019.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246138159.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246462744.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246055786.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245874099.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245982334.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245915875.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246366325.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246184367.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246406234.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246309772.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246278619.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246493031.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comcomaNr
Source: STAMPED CONTRACT.exe, 00000000.00000003.246095684.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246244019.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246138159.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245733889.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246055786.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245653439.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245874099.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245982334.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245629944.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245915875.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245692605.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246366325.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246184367.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245601973.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245566177.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246406234.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246309772.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246278619.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245804289.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comcomd
Source: STAMPED CONTRACT.exe, 00000000.00000003.246095684.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246244019.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245487340.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245339211.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246138159.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245184653.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245733889.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245373781.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245313803.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246055786.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245653439.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245874099.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245982334.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244945073.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245629944.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245915875.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244981444.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245692605.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246184367.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245601973.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245408934.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd
Source: STAMPED CONTRACT.exe, 00000000.00000003.245339211.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245184653.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245373781.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245313803.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244839521.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244590841.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244716470.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244871311.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244774460.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244664517.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244945073.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244981444.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244685393.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245408934.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245236568.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245088265.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244744770.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244642233.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244898992.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245207412.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244621285.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd;N
Source: STAMPED CONTRACT.exe, 00000000.00000003.245184653.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244839521.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244590841.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244716470.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244871311.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244774460.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244503756.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244664517.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244945073.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244981444.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244685393.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245088265.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244744770.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244642233.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244898992.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244621285.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdita
Source: STAMPED CONTRACT.exe, 00000000.00000003.245487340.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245339211.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245184653.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245733889.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245373781.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245313803.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244839521.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244716470.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244871311.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245653439.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245874099.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244774460.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244664517.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244945073.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245629944.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245915875.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244981444.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245692605.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245601973.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244685393.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245408934.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.come.com
Source: STAMPED CONTRACT.exe, 00000000.00000003.244216645.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244246168.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comepkof
Source: STAMPED CONTRACT.exe, 00000000.00000003.246095684.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246244019.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245487340.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246138159.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245733889.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246055786.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245653439.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245874099.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245982334.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245629944.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245915875.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245692605.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246366325.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246184367.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245601973.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245408934.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245566177.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246406234.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246309772.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245442824.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246278619.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comicta
Source: STAMPED CONTRACT.exe, 00000000.00000003.249422211.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.270951519.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249326775.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249155217.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249119841.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comicuWN8
Source: STAMPED CONTRACT.exe, 00000000.00000003.249422211.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249104494.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249326775.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249155217.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249119841.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coml1
Source: STAMPED CONTRACT.exe, 00000000.00000003.246095684.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246244019.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246138159.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246055786.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245982334.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246366325.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246184367.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246406234.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246309772.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246278619.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comlicF
Source: STAMPED CONTRACT.exe, 00000000.00000003.246095684.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249422211.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246244019.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246138159.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249104494.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249326775.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246055786.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249155217.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249119841.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245982334.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246184367.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246309772.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246278619.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: STAMPED CONTRACT.exe, 00000000.00000003.249422211.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.270951519.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249326775.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249155217.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.249119841.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.commNNA
Source: STAMPED CONTRACT.exe, 00000000.00000003.244160565.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comt
Source: STAMPED CONTRACT.exe, 00000000.00000003.245184653.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244871311.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244945073.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244981444.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245236568.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245088265.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244898992.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245207412.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comtoed
Source: STAMPED CONTRACT.exe, 00000000.00000003.246095684.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246244019.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246138159.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245733889.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246055786.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245653439.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245874099.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245982334.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245629944.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245915875.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245692605.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246184367.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245601973.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246309772.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.246278619.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245804289.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comue
Source: STAMPED CONTRACT.exe, 00000000.00000003.245184653.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244945073.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244981444.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245236568.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245088265.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.244898992.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.245207412.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comuev
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: STAMPED CONTRACT.exe, 00000000.00000003.240850167.0000000005829000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.240886828.000000000582A000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.241837648.00000000057F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: STAMPED CONTRACT.exe, 00000000.00000003.241201459.000000000582F000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.241097857.000000000582F000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.241129494.0000000005830000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.241173320.0000000005829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: STAMPED CONTRACT.exe, 00000000.00000003.247108579.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.247090095.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.247133221.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: STAMPED CONTRACT.exe, 00000000.00000003.247090095.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.247231044.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: STAMPED CONTRACT.exe, 00000000.00000003.242518165.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243198581.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243377889.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: STAMPED CONTRACT.exe, 00000000.00000003.242604914.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242555593.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242747229.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242518165.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/)N
Source: STAMPED CONTRACT.exe, 00000000.00000003.242841186.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242805323.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: STAMPED CONTRACT.exe, 00000000.00000003.242406688.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242518165.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/2N
Source: STAMPED CONTRACT.exe, 00000000.00000003.242306926.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242261048.0000000005837000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242282296.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242347916.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/4
Source: STAMPED CONTRACT.exe, 00000000.00000003.242604914.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242406688.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242555593.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242518165.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/;N
Source: STAMPED CONTRACT.exe, 00000000.00000003.243120088.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242841186.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243270592.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242805323.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243028312.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243074364.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242747229.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243296774.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243244185.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243198581.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ENN
Source: STAMPED CONTRACT.exe, 00000000.00000003.242306926.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242604914.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242406688.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242555593.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242347916.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242518165.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/FN
Source: STAMPED CONTRACT.exe, 00000000.00000003.242841186.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242604914.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242805323.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243028312.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242747229.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/NNA
Source: STAMPED CONTRACT.exe, 00000000.00000003.242841186.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242805323.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242747229.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/WN8
Source: STAMPED CONTRACT.exe, 00000000.00000003.242306926.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242406688.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242347916.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242518165.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: STAMPED CONTRACT.exe, 00000000.00000003.242406688.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0p
Source: STAMPED CONTRACT.exe, 00000000.00000003.242406688.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242555593.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242347916.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242518165.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/aNr
Source: STAMPED CONTRACT.exe, 00000000.00000003.242841186.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242604914.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242406688.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242805323.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242555593.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243028312.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242747229.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242347916.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242518165.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: STAMPED CONTRACT.exe, 00000000.00000003.243120088.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242841186.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243327845.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243270592.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242805323.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243028312.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243074364.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243296774.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243244185.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243198581.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243377889.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/)N
Source: STAMPED CONTRACT.exe, 00000000.00000003.242841186.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242604914.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242805323.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242555593.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242747229.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/2N
Source: STAMPED CONTRACT.exe, 00000000.00000003.242841186.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242805323.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.243028312.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242747229.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/;N
Source: STAMPED CONTRACT.exe, 00000000.00000003.242841186.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242604914.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242805323.0000000005838000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.242747229.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/aNr
Source: STAMPED CONTRACT.exe, 00000000.00000003.246953421.0000000005838000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.
Source: STAMPED CONTRACT.exe, 00000000.00000003.247769440.000000000581A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.)
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.240398657.000000000580A000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.241192425.000000000582A000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000003.241173320.0000000005829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: STAMPED CONTRACT.exe, 00000000.00000002.283198266.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: STAMPED CONTRACT.exe, 00000007.00000002.510347221.00000000030F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ckJxF1XAyPwdnwhnXbWu.net
Source: STAMPED CONTRACT.exe, 00000007.00000002.510347221.00000000030F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: mail.hindusthan.com

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.STAMPED CONTRACT.exe.28d639c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 00000000.00000002.277639077.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000007.00000000.268833030.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: STAMPED CONTRACT.exe PID: 5676, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: STAMPED CONTRACT.exe PID: 4668, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
.NET source code contains very large array initializations
Source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bE2C672A3u002d33DEu002d4F8Fu002d977Fu002d0F1A993E2B3Fu007d/u0035D793A23u002d021Cu002d42A3u002dBFF3u002dC1942F153833.cs Large array initialization: .cctor: array initializer size 11626
.NET source code contains very large strings
Source: STAMPED CONTRACT.exe, AddCompanyForm.cs Long String: Length: 20037
Source: UBkncV.exe.0.dr, AddCompanyForm.cs Long String: Length: 20037
Source: 0.0.STAMPED CONTRACT.exe.490000.0.unpack, AddCompanyForm.cs Long String: Length: 20037
Uses 32bit PE files
Source: STAMPED CONTRACT.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.STAMPED CONTRACT.exe.28d639c.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 00000000.00000002.277639077.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000007.00000000.268833030.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: STAMPED CONTRACT.exe PID: 5676, type: MEMORYSTR Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
Source: Process Memory Space: STAMPED CONTRACT.exe PID: 5676, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: STAMPED CONTRACT.exe PID: 4668, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Detected potential crypto function
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_026CE820 0_2_026CE820
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_026CE810 0_2_026CE810
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_026CBF54 0_2_026CBF54
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_04DA49F0 0_2_04DA49F0
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073ACE70 0_2_073ACE70
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A3EE0 0_2_073A3EE0
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A2D00 0_2_073A2D00
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A5470 0_2_073A5470
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073AD320 0_2_073AD320
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A6348 0_2_073A6348
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A3340 0_2_073A3340
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A4A68 0_2_073A4A68
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A4F18 0_2_073A4F18
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A4F08 0_2_073A4F08
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A97A9 0_2_073A97A9
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A8798 0_2_073A8798
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A878A 0_2_073A878A
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A97C8 0_2_073A97C8
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073AC610 0_2_073AC610
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A3E54 0_2_073A3E54
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A7EB9 0_2_073A7EB9
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A3EAA 0_2_073A3EAA
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A7EC8 0_2_073A7EC8
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A8590 0_2_073A8590
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A8580 0_2_073A8580
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A5463 0_2_073A5463
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A5460 0_2_073A5460
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A3330 0_2_073A3330
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A630B 0_2_073A630B
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A8BD8 0_2_073A8BD8
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A8BC8 0_2_073A8BC8
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A7278 0_2_073A7278
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A7269 0_2_073A7269
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A4A58 0_2_073A4A58
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A62B1 0_2_073A62B1
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A81E8 0_2_073A81E8
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A89E0 0_2_073A89E0
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A81D8 0_2_073A81D8
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A89D2 0_2_073A89D2
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073AF0F8 0_2_073AF0F8
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_07BC0040 0_2_07BC0040
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_0156F080 7_2_0156F080
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_0156F3C8 7_2_0156F3C8
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_01566120 7_2_01566120
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_0618B730 7_2_0618B730
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_0618C480 7_2_0618C480
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_06180040 7_2_06180040
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_067B4428 7_2_067B4428
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_067B3148 7_2_067B3148
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_067B1800 7_2_067B1800
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_067B27F8 7_2_067B27F8
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_067B8223 7_2_067B8223
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_067C9051 7_2_067C9051
Sample file is different than original file name gathered from version info
Source: STAMPED CONTRACT.exe, 00000000.00000002.284894736.00000000072C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe, 00000000.00000002.277639077.0000000003899000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBltVIPzWHmHvsmsARomBkAMwAUxtmNfObSPLJV.exe4 vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe, 00000000.00000002.272424508.0000000002891000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe, 00000000.00000002.272424508.0000000002891000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBltVIPzWHmHvsmsARomBkAMwAUxtmNfObSPLJV.exe4 vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe, 00000000.00000003.259882739.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe, 00000000.00000000.236696502.0000000000558000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameIyBr.exe6 vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe, 00000000.00000002.279636796.0000000003A76000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe, 00000000.00000002.279636796.0000000003A76000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameIyBr.exe6 vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe, 00000007.00000000.269166822.0000000000436000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBltVIPzWHmHvsmsARomBkAMwAUxtmNfObSPLJV.exe4 vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe, 00000007.00000002.504200822.00000000010F8000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe Binary or memory string: OriginalFilenameIyBr.exe6 vs STAMPED CONTRACT.exe
Source: STAMPED CONTRACT.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: UBkncV.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: STAMPED CONTRACT.exe Virustotal: Detection: 40%
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File read: C:\Users\user\Desktop\STAMPED CONTRACT.exe Jump to behavior
Source: STAMPED CONTRACT.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\STAMPED CONTRACT.exe "C:\Users\user\Desktop\STAMPED CONTRACT.exe"
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UBkncV" /XML "C:\Users\user\AppData\Local\Temp\tmpBA47.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process created: C:\Users\user\Desktop\STAMPED CONTRACT.exe {path}
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UBkncV" /XML "C:\Users\user\AppData\Local\Temp\tmpBA47.tmp Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process created: C:\Users\user\Desktop\STAMPED CONTRACT.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File created: C:\Users\user\AppData\Roaming\UBkncV.exe Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File created: C:\Users\user\AppData\Local\Temp\tmpBA47.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@6/3@2/1
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: STAMPED CONTRACT.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5700:120:WilError_01
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Mutant created: \Sessions\1\BaseNamedObjects\ZrHZiSlVTUBUacmn
Source: STAMPED CONTRACT.exe String found in binary or memory: Address:/AddressToolStripTextBox-AddressToolStripButton'ToolStripSeparator3'PhoneToolStripLabel
Source: STAMPED CONTRACT.exe String found in binary or memory: Address:/AddressToolStripTextBox-AddressToolStripButton'ToolStripSeparator3'PhoneToolStripLabel
Source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: STAMPED CONTRACT.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: STAMPED CONTRACT.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: STAMPED CONTRACT.exe, AddCompanyForm.cs .Net Code: NewLateBinding.LateCall(dax, null, "Invoke", stackVariable4, null, null, stackVariable13, true)
Source: UBkncV.exe.0.dr, AddCompanyForm.cs .Net Code: NewLateBinding.LateCall(dax, null, "Invoke", stackVariable4, null, null, stackVariable13, true)
Source: 0.0.STAMPED CONTRACT.exe.490000.0.unpack, AddCompanyForm.cs .Net Code: NewLateBinding.LateCall(dax, null, "Invoke", stackVariable4, null, null, stackVariable13, true)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_04DA0428 pushad ; ret 0_2_04DA0429
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_04DAF5E0 push 00000002h; ret 0_2_04DAF5F0
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_073A61EB push ecx; iretd 0_2_073A61EC
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_07BC4F25 push FFFFFF8Bh; iretd 0_2_07BC4F27
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 0_2_07BC4E2A push dword ptr [ebx+ebp-75h]; iretd 0_2_07BC4E35
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_0618B670 push es; ret 7_2_0618B680
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_0618A777 push es; retf 7_2_0618A778
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_0618313B push es; iretd 7_2_0618313C
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_067B7C70 push es; ret 7_2_067B7C80
Source: initial sample Static PE information: section name: .text entropy: 7.757505394635879
Source: initial sample Static PE information: section name: .text entropy: 7.757505394635879
Drops PE files
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File created: C:\Users\user\AppData\Roaming\UBkncV.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UBkncV" /XML "C:\Users\user\AppData\Local\Temp\tmpBA47.tmp
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: STAMPED CONTRACT.exe PID: 5676, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: STAMPED CONTRACT.exe, 00000000.00000002.272424508.0000000002891000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: STAMPED CONTRACT.exe, 00000000.00000002.272424508.0000000002891000.00000004.00000800.00020000.00000000.sdmp, STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe TID: 5908 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe TID: 5252 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe TID: 3672 Thread sleep count: 9519 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Window / User API: threadDelayed 9519 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE
Source: STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: STAMPED CONTRACT.exe, 00000000.00000002.276541490.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Enables debug privileges
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Code function: 7_2_067B2568 LdrInitializeThunk, 7_2_067B2568
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Memory written: C:\Users\user\Desktop\STAMPED CONTRACT.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UBkncV" /XML "C:\Users\user\AppData\Local\Temp\tmpBA47.tmp Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Process created: C:\Users\user\Desktop\STAMPED CONTRACT.exe {path} Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Users\user\Desktop\STAMPED CONTRACT.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Users\user\Desktop\STAMPED CONTRACT.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.277639077.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.268833030.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.510347221.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: STAMPED CONTRACT.exe PID: 5676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: STAMPED CONTRACT.exe PID: 4668, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\STAMPED CONTRACT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000007.00000002.510347221.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: STAMPED CONTRACT.exe PID: 4668, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.0.STAMPED CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.STAMPED CONTRACT.exe.39c1aa0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.277639077.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.268833030.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.510347221.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: STAMPED CONTRACT.exe PID: 5676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: STAMPED CONTRACT.exe PID: 4668, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 680576 Sample: STAMPED CONTRACT.exe Startdate: 08/08/2022 Architecture: WINDOWS Score: 100 29 Snort IDS alert for network traffic 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 11 other signatures 2->35 7 STAMPED CONTRACT.exe 6 2->7         started        process3 file4 19 C:\Users\user\AppData\Roaming\UBkncV.exe, PE32 7->19 dropped 21 C:\Users\user\AppData\Local\...\tmpBA47.tmp, XML 7->21 dropped 23 C:\Users\user\...\STAMPED CONTRACT.exe.log, ASCII 7->23 dropped 37 Injects a PE file into a foreign processes 7->37 11 STAMPED CONTRACT.exe 2 7->11         started        15 schtasks.exe 1 7->15         started        signatures5 process6 dnsIp7 25 hindusthan.com 192.185.46.31, 49741, 587 UNIFIEDLAYER-AS-1US United States 11->25 27 mail.hindusthan.com 11->27 39 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->39 41 Tries to steal Mail credentials (via file / registry access) 11->41 43 Tries to harvest and steal ftp login credentials 11->43 45 Tries to harvest and steal browser information (history, passwords, etc) 11->45 17 conhost.exe 15->17         started        signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.185.46.31
 hindusthan.com United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
hindusthan.com 192.185.46.31 true
mail.hindusthan.com unknown unknown