Windows Analysis Report
321 Amita Technical 16.09.2022.exe

Overview

General Information

Sample Name: 321 Amita Technical 16.09.2022.exe
Analysis ID: 708244
MD5: a2a924c124bbc597a76495b4fb08f906
SHA1: 7ce1c45be6abf27c1b6f6c33ad16a27c4925e51b
SHA256: 9d45370a27c72436041f3ffb82b0c245eea5191c788b574e9656a23054340a61
Tags: exe
Infos:

Detection

AgentTesla, DarkTortilla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected DarkTortilla Crypter
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Machine Learning detection for sample
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Hides that the sample has been downloaded from the Internet (zone.identifier)
Moves itself to temp directory
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection

barindex
Source: 321 Amita Technical 16.09.2022.exe ReversingLabs: Detection: 65%
Source: 321 Amita Technical 16.09.2022.exe Joe Sandbox ML: detected
Source: 4.0.InstallUtil.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 1.2.phine.exe.3d01dda.1.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "logs@multimetals.cfd", "Password": "multimetals.cfd", "Host": "asset@multimetals.cfd"}
Source: 321 Amita Technical 16.09.2022.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 142.250.185.164:443 -> 192.168.2.5:49684 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.185.164:443 -> 192.168.2.5:49687 version: TLS 1.2
Source: 321 Amita Technical 16.09.2022.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: Word.exe.4.dr
Source: Binary string: InstallUtil.pdb source: Word.exe.4.dr
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49687 -> 443
Source: InstallUtil.exe, 00000004.00000002.562334194.0000000003131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: InstallUtil.exe, 00000004.00000002.562334194.0000000003131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: InstallUtil.exe, 00000004.00000002.562334194.0000000003131000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.570367604.000000000348A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aTvxhlG42bxITzBzC.net
Source: InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.570395017.0000000003490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: InstallUtil.exe, 00000004.00000002.575677767.0000000006EC5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.570395017.0000000003490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.570395017.0000000003490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: InstallUtil.exe, 00000004.00000002.575982395.0000000006F25000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: InstallUtil.exe, 00000004.00000002.575954046.0000000006F18000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.570395017.0000000003490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: InstallUtil.exe, 00000004.00000002.574223390.000000000670A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/
Source: InstallUtil.exe, 00000004.00000002.575551872.0000000006E80000.00000004.00000001.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.574556398.000000000677C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0
Source: InstallUtil.exe, 00000004.00000002.574332430.0000000006743000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9cecf6326dbcb
Source: InstallUtil.exe, 00000004.00000002.575583481.0000000006E87000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com:80Z
Source: InstallUtil.exe, 00000004.00000002.574556398.000000000677C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: InstallUtil.exe, 00000004.00000002.562334194.0000000003131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://jtKsKM.com
Source: InstallUtil.exe, 00000004.00000002.570395017.0000000003490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://multimetals.cfd
Source: phine.exe, 00000001.00000003.523826333.00000000067A2000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.438631043.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.361274706.00000000067A8000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.360470623.00000000067A2000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.523637270.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.360882256.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.360669570.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.361061653.00000000067A9000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.361500876.00000000067A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ns.ado/1
Source: phine.exe, 00000001.00000003.523826333.00000000067A2000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.438631043.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.361274706.00000000067A8000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.360470623.00000000067A2000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.523637270.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.360882256.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.360669570.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.361500876.00000000067A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.c/g
Source: phine.exe, 00000001.00000003.523826333.00000000067A2000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.438631043.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.361274706.00000000067A8000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.360470623.00000000067A2000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.523637270.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.360882256.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.360669570.00000000067A5000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.361061653.00000000067A9000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000003.361500876.00000000067A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.cobj
Source: InstallUtil.exe, 00000004.00000002.574523943.0000000006774000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pki.digidentity.eu/validatie0
Source: InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.570395017.0000000003490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0W
Source: InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.570395017.0000000003490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: InstallUtil.exe, 00000004.00000002.575982395.0000000006F25000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/0
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.343046032.00000000028A1000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000002.527680627.0000000002B91000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 00000004.00000002.575954046.0000000006F18000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ancert.com/cps0
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308454333.000000000649F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308177419.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308304317.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308387580.000000000649F000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308454333.000000000649F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com.
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308387580.000000000649F000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308454333.000000000649F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com.m
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308454333.000000000649F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comV
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308454333.000000000649F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comg
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308304317.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comk
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308304317.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308387580.000000000649F000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308454333.000000000649F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comlt
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308454333.000000000649F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comm
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308387580.000000000649F000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308454333.000000000649F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.como.
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308177419.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308304317.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308387580.000000000649F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comx
Source: InstallUtil.exe, 00000004.00000002.574332430.0000000006743000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: InstallUtil.exe, 00000004.00000002.574332430.0000000006743000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: InstallUtil.exe, 00000004.00000002.575954046.0000000006F18000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.chambersign.org1
Source: InstallUtil.exe, 00000004.00000002.576002903.0000000006F28000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: InstallUtil.exe, 00000004.00000002.575677767.0000000006EC5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: InstallUtil.exe, 00000004.00000002.575677767.0000000006EC5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.disig.sk/ca0f
Source: InstallUtil.exe, 00000004.00000002.575530952.0000000006E7C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.e-me.lv/repository0
Source: InstallUtil.exe, 00000004.00000002.575677767.0000000006EC5000.00000004.00000001.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.575530952.0000000006E7C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.339673878.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.316580533.00000000064A1000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.316450459.000000000649A000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354444180.00000000064A1000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.316177968.000000000649A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.316580533.00000000064A1000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.316450459.000000000649A000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.316177968.000000000649A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.come.com
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308036488.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308177419.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308912197.000000000649D000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308752836.0000000006494000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308973438.000000000649A000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309338640.0000000006499000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308973438.000000000649A000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309338640.0000000006499000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/#
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/(
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/1
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309338640.0000000006499000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/D
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Z
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308973438.000000000649A000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309338640.0000000006499000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/adnl
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308912197.000000000649D000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308973438.000000000649A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/es-e
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308752836.0000000006494000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/i
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309338640.0000000006499000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309338640.0000000006499000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/(
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308973438.000000000649A000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309338640.0000000006499000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/M
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308912197.000000000649D000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308752836.0000000006494000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308973438.000000000649A000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/n-u
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308912197.000000000649D000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308973438.000000000649A000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/s_tr
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308912197.000000000649D000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308752836.0000000006494000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308973438.000000000649A000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309338640.0000000006499000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.309160709.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/voit
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.313615932.00000000064B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.i
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308036488.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308177419.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000002.354896208.00000000076A2000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308304317.000000000649E000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308387580.000000000649F000.00000004.00000800.00020000.00000000.sdmp, 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308454333.000000000649F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000003.308036488.000000000649E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnI
Source: InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.570395017.0000000003490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: InstallUtil.exe, 00000004.00000002.573913828.00000000066C0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.570395017.0000000003490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: InstallUtil.exe, 00000004.00000002.562334194.0000000003131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%
Source: InstallUtil.exe, 00000004.00000002.562334194.0000000003131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%appdata
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.343046032.00000000028A1000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000002.527680627.0000000002B91000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.343046032.00000000028A1000.00000004.00000800.00020000.00000000.sdmp, phine.exe, 00000001.00000002.527680627.0000000002B91000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: InstallUtil.exe, 00000004.00000002.575551872.0000000006E80000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.netlock.hu/docs/
Source: InstallUtil.exe, 00000004.00000002.575500401.0000000006E67000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.netlock.net/docs
Source: InstallUtil.exe, 00000004.00000002.562334194.0000000003131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: www.google.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 142.250.185.164:443 -> 192.168.2.5:49684 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.185.164:443 -> 192.168.2.5:49687 version: TLS 1.2

System Summary

barindex
Source: 1.2.phine.exe.3d366ba.2.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.phine.exe.3d366ba.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.2.phine.exe.3ccd4ea.3.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.phine.exe.3ccd4ea.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.2.phine.exe.3dd4130.5.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.phine.exe.3dd4130.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.2.phine.exe.3d9f85a.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.phine.exe.3d9f85a.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.2.phine.exe.3dd4130.5.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.phine.exe.3dd4130.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 4.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.2.phine.exe.3d01dda.1.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.phine.exe.3d01dda.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.2.phine.exe.3ccd4ea.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.phine.exe.3ccd4ea.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.2.phine.exe.3d01dda.1.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.phine.exe.3d01dda.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.2.phine.exe.3d366ba.2.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.phine.exe.3d366ba.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.2.phine.exe.3d9f85a.4.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.phine.exe.3d9f85a.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000001.00000002.543325516.0000000003C3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000001.00000002.545362105.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000004.00000000.447939474.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000001.00000002.543889878.0000000003C98000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.350191112.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.351247039.0000000003AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: 321 Amita Technical 16.09.2022.exe PID: 5436, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: phine.exe PID: 5604, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: InstallUtil.exe PID: 5980, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 4.0.InstallUtil.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bBE52BF32u002d77FEu002d4329u002dA368u002d236FF4A5C92Eu007d/u0039CB256AEu002dBB0Fu002d4ADFu002dBC11u002d081C2621C23C.cs Large array initialization: .cctor: array initializer size 11614
Source: 321 Amita Technical 16.09.2022.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 1.2.phine.exe.3d366ba.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.phine.exe.3d366ba.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.2.phine.exe.3ccd4ea.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.phine.exe.3ccd4ea.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.2.phine.exe.3dd4130.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.phine.exe.3dd4130.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.2.phine.exe.3d9f85a.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.phine.exe.3d9f85a.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.2.phine.exe.3dd4130.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.phine.exe.3dd4130.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 4.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.2.phine.exe.3d01dda.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.phine.exe.3d01dda.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.2.phine.exe.3ccd4ea.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.phine.exe.3ccd4ea.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.2.phine.exe.3d01dda.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.phine.exe.3d01dda.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.2.phine.exe.3d366ba.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.phine.exe.3d366ba.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.2.phine.exe.3d9f85a.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.phine.exe.3d9f85a.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000001.00000002.543325516.0000000003C3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000001.00000002.545362105.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000004.00000000.447939474.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000001.00000002.543889878.0000000003C98000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.350191112.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.351247039.0000000003AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: 321 Amita Technical 16.09.2022.exe PID: 5436, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: phine.exe PID: 5604, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: InstallUtil.exe PID: 5980, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Code function: 0_2_00CDB280 0_2_00CDB280
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Code function: 0_2_00CDD3F0 0_2_00CDD3F0
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Code function: 0_2_00CD6547 0_2_00CD6547
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Code function: 0_2_00CD9970 0_2_00CD9970
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Code function: 0_2_00CD3C50 0_2_00CD3C50
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Code function: 0_2_00CD5E00 0_2_00CD5E00
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Code function: 0_2_00CD39C7 0_2_00CD39C7
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Code function: 0_2_00CDCB08 0_2_00CDCB08
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Code function: 0_2_02876238 0_2_02876238
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_0106D3F0 1_2_0106D3F0
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_0106B2A0 1_2_0106B2A0
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_01069900 1_2_01069900
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_01065DD0 1_2_01065DD0
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_01063C50 1_2_01063C50
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_010627E8 1_2_010627E8
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_0106CA88 1_2_0106CA88
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_02A66238 1_2_02A66238
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_07990040 1_2_07990040
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_07990006 1_2_07990006
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_07996D14 1_2_07996D14
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_07999AD0 1_2_07999AD0
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.349049585.00000000038A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevfdgghyyyzd.dll8 vs 321 Amita Technical 16.09.2022.exe
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.350191112.00000000039A9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNhmfrEvwfhCSyuFJvhevwbpjUkWRhnoPOGCC.exe4 vs 321 Amita Technical 16.09.2022.exe
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.351247039.0000000003AB0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNhmfrEvwfhCSyuFJvhevwbpjUkWRhnoPOGCC.exe4 vs 321 Amita Technical 16.09.2022.exe
Source: 321 Amita Technical 16.09.2022.exe, 00000000.00000002.351904148.0000000004E60000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamevfdgghyyyzd.dll8 vs 321 Amita Technical 16.09.2022.exe
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\Word\Word.exe 46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB
Source: 321 Amita Technical 16.09.2022.exe ReversingLabs: Detection: 65%
Source: 321 Amita Technical 16.09.2022.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe "C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe"
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process created: C:\Users\user\AppData\Local\Temp\phine.exe "C:\Users\user\AppData\Local\Temp\phine.exe"
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process created: C:\Users\user\AppData\Local\Temp\phine.exe "C:\Users\user\AppData\Local\Temp\phine.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\321 Amita Technical 16.09.2022.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@5/3@3/1
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: 321 Amita Technical 16.09.2022.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: 4.0.InstallUtil.exe.400000.0.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.InstallUtil.exe.400000.0.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: 321 Amita Technical 16.09.2022.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 321 Amita Technical 16.09.2022.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: Word.exe.4.dr
Source: Binary string: InstallUtil.pdb source: Word.exe.4.dr

Data Obfuscation

barindex
Source: Yara match File source: 1.2.phine.exe.3d366ba.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3ccd4ea.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d9f85a.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d01dda.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3ccd4ea.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d01dda.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d366ba.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d9f85a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.343398236.00000000028F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.346179647.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.545362105.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.543889878.0000000003C98000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.528157488.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350191112.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.351247039.0000000003AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 321 Amita Technical 16.09.2022.exe PID: 5436, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: phine.exe PID: 5604, type: MEMORYSTR
Source: 321 Amita Technical 16.09.2022.exe, Bd0w/n2P6.cs .Net Code: NewLateBinding.LateCall(NewLateBinding.LateIndexGet(NewLateBinding.LateGet(V_8, null, "GetMethods", new object[0], null, null, null), new object[] { 0 }, null), null, "Invoke", new object[] { null, new object[0] }, null, null, null, true)
Source: 0.0.321 Amita Technical 16.09.2022.exe.ed0000.0.unpack, Bd0w/n2P6.cs .Net Code: NewLateBinding.LateCall(NewLateBinding.LateIndexGet(NewLateBinding.LateGet(V_8, null, "GetMethods", new object[0], null, null, null), new object[] { 0 }, null), null, "Invoke", new object[] { null, new object[0] }, null, null, null, true)
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Code function: 0_2_00CDA77C push esp; iretd 0_2_00CDA77D
Source: C:\Users\user\AppData\Local\Temp\phine.exe Code function: 1_2_0799BF78 push eax; ret 1_2_0799BF85
Source: initial sample Static PE information: section name: .text entropy: 6.864655751113723
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File created: C:\Users\user\AppData\Roaming\Word\Word.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Word Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Word Jump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe File opened: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe\:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe File opened: C:\Users\user\AppData\Local\Temp\phine.exe\:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Word\Word.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: c:\users\user\desktop\321 amita technical 16.09.2022.exe File moved: C:\Users\user\AppData\Local\Temp\phine.exe Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe TID: 5508 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe TID: 5460 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe TID: 5760 Thread sleep time: -15679732462653109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe TID: 5760 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3424 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1244 Thread sleep count: 9711 > 30 Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Window / User API: threadDelayed 9876 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 9711 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: InstallUtil.exe, 00000004.00000002.561193349.0000000001573000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLI
Source: InstallUtil.exe, 00000004.00000002.574556398.000000000677C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: InstallUtil.exe, 00000004.00000002.574556398.000000000677C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW&
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Memory allocated: page read and write | page guard Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Process created: C:\Users\user\AppData\Local\Temp\phine.exe "C:\Users\user\AppData\Local\Temp\phine.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Queries volume information: C:\Users\user\AppData\Local\Temp\phine.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\phine.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\321 Amita Technical 16.09.2022.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information

barindex
Source: Yara match File source: 1.2.phine.exe.3d366ba.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3ccd4ea.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3dd4130.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d9f85a.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3dd4130.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d01dda.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3ccd4ea.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d01dda.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d366ba.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d9f85a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.543325516.0000000003C3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.545362105.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.447939474.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.543889878.0000000003C98000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350191112.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.351247039.0000000003AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.562334194.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 321 Amita Technical 16.09.2022.exe PID: 5436, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: phine.exe PID: 5604, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 5980, type: MEMORYSTR
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: Yara match File source: 00000004.00000002.562334194.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 5980, type: MEMORYSTR

Remote Access Functionality

barindex
Source: Yara match File source: 1.2.phine.exe.3d366ba.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3ccd4ea.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3dd4130.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d9f85a.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3dd4130.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d01dda.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3ccd4ea.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d01dda.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d366ba.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3ab0432.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.phine.exe.3d9f85a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3ae4d08.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a47292.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.3a129b2.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.321 Amita Technical 16.09.2022.exe.39de0c2.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.543325516.0000000003C3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.545362105.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.447939474.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.543889878.0000000003C98000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.350191112.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.351247039.0000000003AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.562334194.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 321 Amita Technical 16.09.2022.exe PID: 5436, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: phine.exe PID: 5604, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 5980, type: MEMORYSTR
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs