Edit tour

Windows Analysis Report
Cpvgbsz3gu.exe

Overview

General Information

Sample Name:	Cpvgbsz3gu.exe
Original Sample Name:	003050a0d5ade7c44587794f418f1fe17ec66bbeb77f26fe3477846af60f6252.exe
Analysis ID:	840956
MD5:	b297ff6e4ddf93de83ba48ca4a47222a
SHA1:	304031df1a2b25161731f5463f31420001786588
SHA256:	003050a0d5ade7c44587794f418f1fe17ec66bbeb77f26fe3477846af60f6252
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

.NET source code references suspicious native API functions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

May check the online IP address of the machine

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains method to dynamically call methods (often used by packers)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

Cpvgbsz3gu.exe (PID: 6992 cmdline: C:\Users\user\Desktop\Cpvgbsz3gu.exe MD5: B297FF6E4DDF93DE83BA48CA4A47222A)

Cpvgbsz3gu.exe (PID: 3216 cmdline: {path} MD5: B297FF6E4DDF93DE83BA48CA4A47222A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based keylogger and RAT readily available to actors. Logs keystrokes and the host's clipboard and beacons this information back to the C2.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/ https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.panservis.rs", "Username": "office@panservis.rs", "Password": "M8KQPEmv2a+"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.576354013.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.343712436.00000000037DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: Cpvgbsz3gu.exe PID: 6992	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Cpvgbsz3gu.exe PID: 3216	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Cpvgbsz3gu.exe PID: 3216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Cpvgbsz3gu.exe.3994878.2.unpack	MSIL_SUSP_OBFUSC_XorStringsNet	Detects XorStringsNET string encryption, and other obfuscators derived from it	dr4k0nia	0x17c6a:$pattern: 06 1E 58 07 8E 69 FE 17 0x269d2:$a2: _CorExeMain 0x227fe:$a3: mscorlib 0x23bdd:$a4: .cctor 0x22559:$a6: <Module>
0.2.Cpvgbsz3gu.exe.3994878.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.Cpvgbsz3gu.exe.400000.0.unpack	MSIL_SUSP_OBFUSC_XorStringsNet	Detects XorStringsNET string encryption, and other obfuscators derived from it	dr4k0nia	0x19a6a:$pattern: 06 1E 58 07 8E 69 FE 17 0x287d2:$a2: _CorExeMain 0x245fe:$a3: mscorlib 0x259dd:$a4: .cctor 0x24359:$a6: <Module>
1.2.Cpvgbsz3gu.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Cpvgbsz3gu.exe.3994878.2.raw.unpack	MSIL_SUSP_OBFUSC_XorStringsNet	Detects XorStringsNET string encryption, and other obfuscators derived from it	dr4k0nia	0x19a6a:$pattern: 06 1E 58 07 8E 69 FE 17 0x4288a:$pattern: 06 1E 58 07 8E 69 FE 17 0x287d2:$a2: _CorExeMain 0x515f2:$a2: _CorExeMain 0x245fe:$a3: mscorlib 0x4d41e:$a3: mscorlib 0x259dd:$a4: .cctor 0x4e7fd:$a4: .cctor 0x24359:$a6: <Module> 0x4d179:$a6: <Module>
0.2.Cpvgbsz3gu.exe.3994878.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Cpvgbsz3gu.exe.38eae28.3.raw.unpack	MSIL_SUSP_OBFUSC_XorStringsNet	Detects XorStringsNET string encryption, and other obfuscators derived from it	dr4k0nia	0xc34ba:$pattern: 06 1E 58 07 8E 69 FE 17 0xec2da:$pattern: 06 1E 58 07 8E 69 FE 17 0x7ff72:$a2: _CorExeMain 0xd2222:$a2: _CorExeMain 0xfb042:$a2: _CorExeMain 0x530a7:$a3: mscorlib 0xce04e:$a3: mscorlib 0xf6e6e:$a3: mscorlib 0x53316:$a4: .cctor 0xcf42d:$a4: .cctor 0xf824d:$a4: .cctor 0xcdda9:$a6: <Module> 0xf6bc9:$a6: <Module>
0.2.Cpvgbsz3gu.exe.38eae28.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 3 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Cpvgbsz3gu.exe

ReversingLabs: Detection: 48%

Machine Learning detection for sample

Source: Cpvgbsz3gu.exe

Joe Sandbox ML: detected

Source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 0.2.Cpvgbsz3gu.exe.3994878.2.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.panservis.rs", "Username": "office@panservis.rs", "Password": "M8KQPEmv2a+"}

Source: Cpvgbsz3gu.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 64.185.227.155:443 -> 192.168.2.4:49691 version: TLS 1.2

Source: Cpvgbsz3gu.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: YIa8Lnj.pdb source: Cpvgbsz3gu.exe

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_04743348
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_04744020
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_04743337

Networking

May check the online IP address of the machine

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	DNS query: name: api.ipify.org

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Joe Sandbox View	IP Address: 185.118.171.10 185.118.171.10
Source: Joe Sandbox View	IP Address: 64.185.227.155 64.185.227.155
Source: Joe Sandbox View	IP Address: 64.185.227.155 64.185.227.155

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.4:49699 -> 185.118.171.10:587

Source: global traffic

TCP traffic: 192.168.2.4:49699 -> 185.118.171.10:587

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443

Source: Cpvgbsz3gu.exe, 00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C67000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.577221243.0000000001950000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Cpvgbsz3gu.exe, 00000001.00000002.577221243.00000000018B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Cpvgbsz3gu.exe, 00000001.00000002.577221243.000000000188A000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.577221243.0000000001963000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C47000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C67000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: Cpvgbsz3gu.exe, 00000001.00000002.577221243.00000000018B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.comlR
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Cpvgbsz3gu.exe, 00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.panservis.rs
Source: Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C47000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.577221243.000000000188A000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.577221243.0000000001963000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C67000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.577221243.0000000001950000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C3F000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Cpvgbsz3gu.exe	String found in binary or memory: http://outage.report/
Source: Cpvgbsz3gu.exe, 00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://panservis.rs
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.578029102.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Cpvgbsz3gu.exe, 00000000.00000002.355326343.0000000006992000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Cpvgbsz3gu.exe, 00000001.00000002.578029102.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Cpvgbsz3gu.exe, 00000001.00000002.578029102.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Cpvgbsz3gu.exe	String found in binary or memory: https://fast.comIhttps://www.speakeasy.net/speedtest/
Source: Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C47000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C67000.00000004.00000020.00020000.00000000.sdmp, Cpvgbsz3gu.exe, 00000001.00000002.583971068.0000000006C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: Cpvgbsz3gu.exe	String found in binary or memory: https://speedtest.net
Source: Cpvgbsz3gu.exe	String found in binary or memory: https://steamstat.us/_https://support.xbox.com/en-US/xbox-live-statusGhttp://downforeveryoneorjustme
Source: Cpvgbsz3gu.exe	String found in binary or memory: https://support.rockstargames.com/hc/en-us/articles/200426246-GTA-Online-Server-Status-Latest-Update
Source: Cpvgbsz3gu.exe	String found in binary or memory: https://testmy.net/Ehttps://www.verizon.com/speedtest/;http://speedtest.xfinity.com/7https://www.ipl
Source: Cpvgbsz3gu.exe	String found in binary or memory: https://www.akamai.com/uk/en/solutions/intelligent-platform/visualizing-akamai/real-time-web-monitor
Source: Cpvgbsz3gu.exe	String found in binary or memory: https://www.de-cix.net/en/locations/united-states/new-york/statistics)https://www.draw.io/7http://ma
Source: Cpvgbsz3gu.exe	String found in binary or memory: https://www.nintendo.com/consumer/network/en_na/network_status.jspKhttps://status.playstation.com/en

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 64.185.227.155:443 -> 192.168.2.4:49691 version: TLS 1.2

Source: Cpvgbsz3gu.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0.2.Cpvgbsz3gu.exe.3994878.2.unpack, type: UNPACKEDPE	Matched rule: MSIL_SUSP_OBFUSC_XorStringsNet author = dr4k0nia, description = Detects XorStringsNET string encryption, and other obfuscators derived from it, score = 26/03/2023, version = 1.0, reference = https://github.com/dr4k0nia/yara-rules
Source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MSIL_SUSP_OBFUSC_XorStringsNet author = dr4k0nia, description = Detects XorStringsNET string encryption, and other obfuscators derived from it, score = 26/03/2023, version = 1.0, reference = https://github.com/dr4k0nia/yara-rules
Source: 0.2.Cpvgbsz3gu.exe.3994878.2.raw.unpack, type: UNPACKEDPE	Matched rule: MSIL_SUSP_OBFUSC_XorStringsNet author = dr4k0nia, description = Detects XorStringsNET string encryption, and other obfuscators derived from it, score = 26/03/2023, version = 1.0, reference = https://github.com/dr4k0nia/yara-rules
Source: 0.2.Cpvgbsz3gu.exe.38eae28.3.raw.unpack, type: UNPACKEDPE	Matched rule: MSIL_SUSP_OBFUSC_XorStringsNet author = dr4k0nia, description = Detects XorStringsNET string encryption, and other obfuscators derived from it, score = 26/03/2023, version = 1.0, reference = https://github.com/dr4k0nia/yara-rules

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 0_2_04740040	0_2_04740040
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 0_2_04744020	0_2_04744020
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 0_2_04740007	0_2_04740007
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_017FA9D8	1_2_017FA9D8
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_017FC998	1_2_017FC998
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_017F9DC0	1_2_017F9DC0
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_017FA108	1_2_017FA108
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_06F3B7A8	1_2_06F3B7A8
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_06F35228	1_2_06F35228
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_06F361F8	1_2_06F361F8
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_06F387B8	1_2_06F387B8
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_0708356C	1_2_0708356C
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_0708FBB0	1_2_0708FBB0
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_0708A1FC	1_2_0708A1FC
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Code function: 1_2_0708EBB0	1_2_0708EBB0

Source: Cpvgbsz3gu.exe, 00000000.00000002.343712436.00000000037DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Cpvgbsz3gu.exe
Source: Cpvgbsz3gu.exe, 00000000.00000002.343712436.00000000037DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename857b26fb-aee6-4707-9f23-eb8bcc8db6cb.exe4 vs Cpvgbsz3gu.exe
Source: Cpvgbsz3gu.exe, 00000000.00000000.305070957.0000000000372000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameYIa8Lnj.exe< vs Cpvgbsz3gu.exe
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002823000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename857b26fb-aee6-4707-9f23-eb8bcc8db6cb.exe4 vs Cpvgbsz3gu.exe
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Cpvgbsz3gu.exe
Source: Cpvgbsz3gu.exe, 00000000.00000002.358113559.00000000072B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Cpvgbsz3gu.exe
Source: Cpvgbsz3gu.exe, 00000001.00000002.577221243.000000000188A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Cpvgbsz3gu.exe
Source: Cpvgbsz3gu.exe, 00000001.00000002.576616790.00000000014F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Cpvgbsz3gu.exe
Source: Cpvgbsz3gu.exe, 00000001.00000002.576354013.000000000042C000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename857b26fb-aee6-4707-9f23-eb8bcc8db6cb.exe4 vs Cpvgbsz3gu.exe
Source: Cpvgbsz3gu.exe	Binary or memory string: OriginalFilenameYIa8Lnj.exe< vs Cpvgbsz3gu.exe

Source: Cpvgbsz3gu.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Cpvgbsz3gu.exe

ReversingLabs: Detection: 48%

Source: Cpvgbsz3gu.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Cpvgbsz3gu.exe C:\Users\user\Desktop\Cpvgbsz3gu.exe
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process created: C:\Users\user\Desktop\Cpvgbsz3gu.exe {path}
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process created: C:\Users\user\Desktop\Cpvgbsz3gu.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Cpvgbsz3gu.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@4/2

Source: Cpvgbsz3gu.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/lMWvyIaOafDQc5MFHs.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack, A/P1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack, A/P1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack, a/aA1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack, a/aN1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack, a/am2.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack, a/ak2.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Cpvgbsz3gu.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Cpvgbsz3gu.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Cpvgbsz3gu.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: YIa8Lnj.pdb source: Cpvgbsz3gu.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/QukawpXNnbSs7fCAuE.cs

.Net Code: LAV0v1AXQ7 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/lMWvyIaOafDQc5MFHs.cs

.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Code function: 1_2_06F3A44F push es; ret

1_2_06F3A460

Source: initial sample

Static PE information: section name: .text entropy: 7.140662747957355

Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/QukawpXNnbSs7fCAuE.cs	High entropy of concatenated method names: '.ctor', 'Mxg0AKqB08', 'mJ1048o2pp', 'P4k0CKPLZx', 'KXy0DTcS9B', 'dTl0SKI9Vo', 'vA20JUTjFX', 'EBU07LFLKD', 'qyi0f1BAhn', 'tj60l047Nd'
Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/BdqaAu6xY0mj2ceBJW.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'Wr2poanLO', 'uk3Vmpy93h', 'BwWVPO7iPZ', 'onkVAmO4n7', 'aqlVRnHG1x', 'touVw5JUup', 'xgkV93A4HT', 'gkBVgekams'
Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/LjRxZ8sXAn6kjJxhiy.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'jRqeckiC4m', 'bL1VFu64iu', 'QpHVW4nxL3', 'f26emnHQ2K', 'ASfeP7Q2A0', 'vy9TgO4A4x', 'gEBTB8dTtK', 'p5HTSAYGtg'
Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/jq9M772FWIktiMfxiR.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'bfLRCfoWgY', 'eLXnFNG4DA', 'cclnWtufIS', 'co9nEH6Fte', 'iW2n6M1biP', 'AghnbrPJMa', 'olUnKa0byE', 'posnm4egTe'
Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/IKpUW3GYjIjQHmcxdx.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'STlyu9B8kq', 'tJPexKla2d', 'y07eCbuGsX', 'TGheSAlq8w', 'V9Ie74vnhA', 'xmmeDZuBRY', 'F2ceHOA7PB', 'oGcekXFYyk'
Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/lMWvyIaOafDQc5MFHs.cs	High entropy of concatenated method names: '.cctor', 'VbGHjQtRt3edg', 'FKnkYNHGht', 'D4gkPbla9X', 'A2CkaJr3Ty', 'UaDkbl2PCX', 'hInkUOg3Hu', 'lqIkjwjNkA', 'dXMkGY9JsQ', 'v4OkrMhLdS'
Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/ypEO0Jo0DFgulKGvGN.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'PaAEBocYcH', 'amETQcFqRb', 'r6RTpNfpWK', 'KGE2m4FR1d', 'KiL2P16MCG', 'XFN2A1YIUF', 'w5J2Rk6p9D', 'pEqTrVwkvC'
Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/sef76UrqimH390Aejj.cs	High entropy of concatenated method names: 'Q0LhZePY9I', 'e18hTq0tbQ', 'lKrhHcxb0K', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'DTbUXN7kUnmPooOuHs', 'eCoqwuhUJnBpYWj3QH', 'bHhmYpsS1uN8vmbrpB', 'd6BXXAOYS2nYRcdrYN'
Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/ar1rPZ0oRLR7fDMDkm.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'XoWx9PkHm', 'etmVnNq9NK', 'RkyV2QcgsK', 'dLWVIAvB3p', 'iagVY23LkJ', 'bL1VFu64iu', 'QpHVW4nxL3', 'XUwVErGvdT'
Source: Cpvgbsz3gu.exe, PingDashboard.My/MySettings.cs	High entropy of concatenated method names: '.cctor', '.ctor', 'AutoSaveSettings', 'get_Default', 'Sc6Y9cRrMCl6GsbFln', 'UPLlhPXnMtpb5c9uO1', 'o9YSaybNMjvnZ7iudT', 'jQvDiWJcmkKjfnaDBv', 'QsY29hdVtCcok3HZJp', 'DGofxtje3hrQmSvVvO'

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Cpvgbsz3gu.exe PID: 6992, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 6960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 6988	Thread sleep count: 2356 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -99827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -99704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -99416s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -99265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -99156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -99047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -98937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe TID: 5276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Window / User API: threadDelayed 2356

Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 99827	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 99704	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 99416	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 99265	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 99156	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 98937	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Cpvgbsz3gu.exe, 00000000.00000002.331388257.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: Cpvgbsz3gu.exe, 00000001.00000003.351758903.0000000001937000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: Cpvgbsz3gu.exe, nGgL6XbBbUYVBtSDRB/lMWvyIaOafDQc5MFHs.cs	Reference to suspicious API methods: ('z50kmEQBY5', 'LoadLibrary@kernel32'), ('LIBkpRmPbH', 'GetProcAddress@kernel32')
Source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack, A/C1.cs	Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Memory written: C:\Users\user\Desktop\Cpvgbsz3gu.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Process created: C:\Users\user\Desktop\Cpvgbsz3gu.exe {path}

Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Users\user\Desktop\Cpvgbsz3gu.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Users\user\Desktop\Cpvgbsz3gu.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Code function: 1_2_017FF164 GetUserNameW,

1_2_017FF164

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Cpvgbsz3gu.exe PID: 3216, type: MEMORYSTR
Source: Yara match	File source: 0.2.Cpvgbsz3gu.exe.3994878.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Cpvgbsz3gu.exe.3994878.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Cpvgbsz3gu.exe.38eae28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.576354013.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.343712436.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\Cpvgbsz3gu.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Cpvgbsz3gu.exe PID: 3216, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000001.00000002.578029102.00000000033AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Cpvgbsz3gu.exe PID: 3216, type: MEMORYSTR
Source: Yara match	File source: 0.2.Cpvgbsz3gu.exe.3994878.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Cpvgbsz3gu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Cpvgbsz3gu.exe.3994878.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Cpvgbsz3gu.exe.38eae28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.576354013.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.343712436.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	111 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	1 Account Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	114 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	23 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	23 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Process Injection	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Cpvgbsz3gu.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Cpvgbsz3gu.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Cpvgbsz3gu.exe