Edit tour

Windows Analysis Report
AFPviewer.exe

Overview

General Information

Sample name:	AFPviewer.exe
Analysis ID:	1671898
MD5:	8d8006c2c512f23e58772a1af281409e
SHA1:	65a910e584be0098a1eabbd9a4bc5ebae42773ad
SHA256:	fbe1f314a856b44895dee249dab462422bfbdd6da4970bfc63f390a6de8bac40

Detection

Score:	1
Range:	0 - 100
Confidence:	60%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w11x64_office

AFPviewer.exe (PID: 3464 cmdline: "C:\Users\user\Desktop\AFPviewer.exe" MD5: 8D8006C2C512F23E58772A1AF281409E)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: AFPviewer.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: AFPviewer.exe

Static PE information: certificate valid

Source: AFPviewer.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: AFPviewer.exe	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: AFPviewer.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-codeSigning-ECC-384-R2.cer0
Source: AFPviewer.exe	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: AFPviewer.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-codeSigning-ECC-384-R2.crl0
Source: AFPviewer.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-ecc-RootCA.crl0
Source: AFPviewer.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: AFPviewer.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: AFPviewer.exe	String found in binary or memory: http://ocsps.ssl.com0?
Source: AFPviewer.exe	String found in binary or memory: http://ocsps.ssl.com0Q
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sajatypeworks.comi
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sajatypeworks.comk
Source: AFPviewer.exe, 00000001.00000002.4128332272.0000000003561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFL
Source: AFPviewer.exe	String found in binary or memory: http://www.CompulsiveCode.com/images/AFPviewer_ReleaseVersion.XML
Source: AFPviewer.exe	String found in binary or memory: http://www.CompulsiveCode.com/images/AFPviewer_ReleaseVersion.XML_New
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: AFPviewer.exe	String found in binary or memory: http://www.compulsivecode.com/Project_AFPviewer.aspxGYou
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: AFPviewer.exe, 00000001.00000002.4132182924.00000000070AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmde
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: AFPviewer.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt0
Source: AFPviewer.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/cascadia-code/blob/main/LICENSE).
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/cascadia-code/blob/master/LICENSE).
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scripts.sil.org/OFL
Source: AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scripts.sil.org/OFL)
Source: AFPviewer.exe	String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=jesse_programmer%40yahoo%2ecom&lc=US&i
Source: AFPviewer.exe	String found in binary or memory: https://www.ssl.com/repository0

Source: AFPviewer.exe, 00000001.00000002.4126756365.0000000001830000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs AFPviewer.exe

Source: AFPviewer.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: AFPviewer.exe, PDFobjFunctions.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, PDFobjFunctions.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, PDFobjFunctions.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, PDFobjFunctions.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, PDFobjFunctions.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, PDFobjFunctions.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, PDFobjFunctions.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, modFileAPI.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, modFileAPI.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, modFileAPI.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, modFileAPI.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, modFileAPI.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: AFPviewer.exe, modFileAPI.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: clean1.winEXE@1/3@0/0

Source: C:\Users\user\Desktop\AFPviewer.exe

File created: C:\Users\user\Documents\AFPviewer_Log.txt

Jump to behavior

Source: C:\Users\user\Desktop\AFPviewer.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\AFPviewer.exe

File created: C:\Users\user\AppData\Local\Temp\tmpFC3D.tmp

Jump to behavior

Source: AFPviewer.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: AFPviewer.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\AFPviewer.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Users\user\Desktop\AFPviewer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\AFPviewer.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: AFPviewer.exe

Static PE information: certificate valid

Source: AFPviewer.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: AFPviewer.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: AFPviewer.exe

Static file information: File size 4486776 > 1048576

Source: AFPviewer.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x443c00

Source: AFPviewer.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\AFPviewer.exe	Memory allocated: 33D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Memory allocated: 3560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Memory allocated: 33D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\AFPviewer.exe

Window / User API: threadDelayed 363

Jump to behavior

Source: C:\Users\user\Desktop\AFPviewer.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Users\user\Desktop\AFPviewer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.21.3231.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.21.3231.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SansSerifCollection.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SegUIVar.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SegUIVar.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SegUIVar.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SegUIVar.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SegUIVar.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SegUIVar.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SegUIVar.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SitkaVF.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SitkaVF-Italic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AFPviewer.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AFPviewer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	1 Archive Collected Data	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
AFPviewer.exe	1%	Virustotal		Browse
AFPviewer.exe	3%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.galapagosdesign.com/staff/dennis.htmde	0%	Avira URL Cloud	safe
http://sajatypeworks.comi	0%	Avira URL Cloud	safe
http://www.compulsivecode.com/Project_AFPviewer.aspxGYou	0%	Avira URL Cloud	safe
http://www.CompulsiveCode.com/images/AFPviewer_ReleaseVersion.XML_New	0%	Avira URL Cloud	safe
http://www.CompulsiveCode.com/images/AFPviewer_ReleaseVersion.XML	0%	Avira URL Cloud	safe
http://sajatypeworks.comk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt0	AFPviewer.exe	false		high
http://www.apache.org/licenses/LICENSE-2.0	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.compulsivecode.com/Project_AFPviewer.aspxGYou	AFPviewer.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=jesse_programmer%40yahoo%2ecom&lc=US&i	AFPviewer.exe	false		high
http://sajatypeworks.comi	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scripts.sil.org/OFL)	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsps.ssl.com0?	AFPviewer.exe	false		high
http://sajatypeworks.comk	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	AFPviewer.exe	false		high
http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q	AFPviewer.exe	false		high
http://crls.ssl.com/SSLcom-SubCA-codeSigning-ECC-384-R2.crl0	AFPviewer.exe	false		high
http://ocsps.ssl.com0	AFPviewer.exe	false		high
http://www.CompulsiveCode.com/images/AFPviewer_ReleaseVersion.XML	AFPviewer.exe	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htmde	AFPviewer.exe, 00000001.00000002.4132182924.00000000070AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.CompulsiveCode.com/images/AFPviewer_ReleaseVersion.XML_New	AFPviewer.exe	false	Avira URL Cloud: safe	unknown
https://github.com/microsoft/cascadia-code/blob/main/LICENSE).	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crls.ssl.com/ssl.com-rsa-RootCA.crl0	AFPviewer.exe	false		high
http://www.fontbureau.com/designers/frere-jones.html	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0	AFPviewer.exe	false		high
http://cert.ssl.com/SSLcom-SubCA-codeSigning-ECC-384-R2.cer0	AFPviewer.exe	false		high
https://scripts.sil.org/OFL	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crls.ssl.com/ssl.com-ecc-RootCA.crl0	AFPviewer.exe	false		high
http://www.jiyu-kobo.co.jp/	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ssl.com/repository0	AFPviewer.exe	false		high
http://www.galapagosdesign.com/DPlease	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://scripts.sil.org/OFL	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AFPviewer.exe, 00000001.00000002.4128332272.0000000003561000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsps.ssl.com0Q	AFPviewer.exe	false		high
https://github.com/microsoft/cascadia-code/blob/master/LICENSE).	AFPviewer.exe, 00000001.00000002.4132391936.0000000008272000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1671898
Start date and time:	2025-04-23 11:56:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AFPviewer.exe
Detection:	CLEAN
Classification:	clean1.winEXE@1/3@0/0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SystemSettingsBroker.exe, SIHClient.exe, appidcertstorecheck.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.29.183.29, 20.12.23.50
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\tmpFC3D.tmp

Download File

Process:	C:\Users\user\Desktop\AFPviewer.exe
File Type:	color profile 2.4, type HDM, CMYK/Lab-prtr device by HDM, 1803144 bytes, 14-2-2020 21:34:02, 0xd71149641d56c2e9 MD5
Category:	dropped
Size (bytes):	1803144
Entropy (8bit):	7.460099950196503
Encrypted:	false
SSDEEP:	49152:Vz0o7AgPFnRvJYIaT5lXpPEsrbNtUWw+ye:Vz0o79rRYIQ8srbv
MD5:	B1E77584AE1CA976F24E52EB3AFEF5F1
SHA1:	FF49B279E66D6F2568E71C8BB523A6CF7ACF1C5F
SHA-256:	D5C6630C8DE85913BB10E6D350C03EB37468C1B5BF45542F75DA4EBB1CE0C0DC
SHA-512:	9F2DCC7CE3E3998131190BEA05EDC357ED2B78B43836442E05EAD15BE270B04C1363CA4E04C110A089DAF9EB47D67243A1CA0D849EAFFAA471883B94602EA5F2
Malicious:	false
Reputation:	low
Preview:	....HDM .@..prtrCMYKLab ........."..acsp.......................................-HDM ..Id.V..v......E................................A2B0... ...4A2B1...T...4A2B2... ...4B2A0......q<B2A1......=.B2A2......8.cprt.......sdesc.......egamt...p...0hd10........kTRC...4....targ...@...4wtpt...t....mft2................................................................................................................ !!""##$$%%&&''(())++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{\|\|}}~~.................................................................................................................................................................................................................................................................................................................................. !!""##$$%%&&''(())++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHII

C:\Users\user\AppData\Local\Temp\tmpFD28.tmp

Download File

Process:	C:\Users\user\Desktop\AFPviewer.exe
File Type:	color profile 2.4, type HDM, CMYK/Lab-prtr device by HDM, 1803144 bytes, 14-2-2020 21:34:02, 0xd71149641d56c2e9 MD5
Category:	dropped
Size (bytes):	1803144
Entropy (8bit):	7.460099950196503
Encrypted:	false
SSDEEP:	49152:Vz0o7AgPFnRvJYIaT5lXpPEsrbNtUWw+ye:Vz0o79rRYIQ8srbv
MD5:	B1E77584AE1CA976F24E52EB3AFEF5F1
SHA1:	FF49B279E66D6F2568E71C8BB523A6CF7ACF1C5F
SHA-256:	D5C6630C8DE85913BB10E6D350C03EB37468C1B5BF45542F75DA4EBB1CE0C0DC
SHA-512:	9F2DCC7CE3E3998131190BEA05EDC357ED2B78B43836442E05EAD15BE270B04C1363CA4E04C110A089DAF9EB47D67243A1CA0D849EAFFAA471883B94602EA5F2
Malicious:	false
Reputation:	low
Preview:	....HDM .@..prtrCMYKLab ........."..acsp.......................................-HDM ..Id.V..v......E................................A2B0... ...4A2B1...T...4A2B2... ...4B2A0......q<B2A1......=.B2A2......8.cprt.......sdesc.......egamt...p...0hd10........kTRC...4....targ...@...4wtpt...t....mft2................................................................................................................ !!""##$$%%&&''(())++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ[[\\]]^^__``aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{\|\|}}~~.................................................................................................................................................................................................................................................................................................................................. !!""##$$%%&&''(())++,,--..//00112233445566778899::;;<<==>>??@@AABBCCDDEEFFGGHHII

C:\Users\user\Documents\AFPviewer_Log.txt

Download File

Process:	C:\Users\user\Desktop\AFPviewer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	659
Entropy (8bit):	4.87151666584846
Encrypted:	false
SSDEEP:	12:u8ITIDS3jv1eDAGxDkTbwKw3H5IIwkppVz2wr+DVOX8x:u8KIWzsVJH2UpdrMU8x
MD5:	290F70207B21648E5AEC1794925C9820
SHA1:	C5014013B9ECA101F1B9E162833F6DDE61078DD3
SHA-256:	2C90D8B914FC2B7D7FAA77D7AD70989DEA156B6E9DED6DA8D1B61382D71FB637
SHA-512:	88621307D9A1F7503C9301B6BA19EAB4CC149EFD416566962A9AD185F6627CF3174431D85B7E42BA6DFE56F48BE534FBFA4FD5E3939F321BB1A4E7C04C515FBA
Malicious:	false
Reputation:	low
Preview:	2025-04-23 05:57:26 AFPviewer StartUp with Debug Logging enabled...2025-04-23 05:57:26 Updating MRU Menu...2025-04-23 05:57:26 Initializing User Interface...2025-04-23 05:57:26 Updating Zoom settings...2025-04-23 05:57:26 Updating other settings...2025-04-23 05:57:27 Initializing paths...2025-04-23 05:57:27 Initializing slideshow variables...2025-04-23 05:57:27 Initializing resource paths...2025-04-23 05:57:27 Restoring position...2025-04-23 05:57:27 Positioning UI controls...2025-04-23 05:57:27 Showing main form...2025-04-23 05:57:27 Checking command line...2025-04-23 05:57:27 Updating Navigation frame...2025-04-23 05:57:27 Initialization complete...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.9803809649117285
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	AFPviewer.exe
File size:	4'486'776 bytes
MD5:	8d8006c2c512f23e58772a1af281409e
SHA1:	65a910e584be0098a1eabbd9a4bc5ebae42773ad
SHA256:	fbe1f314a856b44895dee249dab462422bfbdd6da4970bfc63f390a6de8bac40
SHA512:	10122a1fc8de7fba18c641dc3167e38b0d7ec00b0802e8edf6ad1fbac6b285933c7d78f6195207fb63797a5fd402bac3e38384f14f9b28a061ce0bc0bc10f2af
SSDEEP:	98304:oEFpUDXqHHfIJTr3hls8z0o79rRYIQ8srbc:NpUDXiHwJPHVz1BrLYbc
TLSH:	F726AFED3BC4C9C1F52E9B3D4AB20C1063F2AD1793926A4D6AD4B7742F713919D086A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g..............P..<D.. .......PD.. ...`D...@.. ........................D.....C.E...`................................

File Icon


Icon Hash:	4d2da56d2d262626

Static PE Info

General

Entrypoint:	0x845006
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67DDA581 [Fri Mar 21 17:44:33 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=SSL.com Code Signing Intermediate CA ECC R2, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	18/03/2025 16:51:34 17/03/2028 16:51:34
Subject Chain	CN=Jesse Yeager, O=Jesse Yeager, L=Warren, S=Michigan, C=US
Version:	3
Thumbprint MD5:	99E01DF35FB617D3F41135251C42C01F
Thumbprint SHA-1:	BAE6EC8B95DA10DB1110BB6E2CEF8FDFFA6A2FFD
Thumbprint SHA-256:	30F06369A6CB81B4A09688259AA549D76DBA25697A1F0409FF5F047DA2C143E7
Serial:	55D665EFC7C83183B7CEF15D451F4774

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
or dl, bh
and edi, dword ptr [3D4CCCCDh]
call far 0000h : 003F5999h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add dword ptr [eax], eax
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add dword ptr [eax], eax
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add dword ptr [eax], eax
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax+3E991687h], al
xchg dword ptr [esi], edx
cdq
xchg dword ptr [esi], edx
cdq
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+20h], 00000010h
or byte ptr [edx+eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x444fb4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x446000	0x1df4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x445e00	0x1878
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x448000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x443a20	0x443c00	a6a2e0e59e98cec82c7daf1f43b208a1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x446000	0x1df4	0x1e00	c284d34249afea19942e5385fbc067da	False	0.3692708333333333	data	4.9694338315331645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x448000	0xc	0x200	b7c956bb7f26f537d4208de07f832ec7	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x446100	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 0	0.30987654320987656
RT_GROUP_ICON	0x446db8	0x14	data	1.15
RT_VERSION	0x446ddc	0x3aa	Dyalog APL workspace 32-bit classic big-endian version 52.0	0.42963752665245203
RT_MANIFEST	0x447198	0xc58	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.3920886075949367

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments	AFPviewer. Written by Jesse Yeager. Started on 04-10-2003.
CompanyName	Jesse Yeager
FileDescription	AFPviewer
FileVersion	1.0.9211.24736
InternalName	AFPviewer.exe
LegalCopyright
LegalTrademarks
OriginalFilename	AFPviewer.exe
ProductName
ProductVersion	1.0.9211.24736
Assembly Version	1.0.9211.24736

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

• AFPviewer.exe

Click to jump to process

Memory Usage

• AFPviewer.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

System Behavior

Analysis Process: AFPviewer.exePID: 3464, Parent PID: 2712

Function Logs

General

Target ID:	1
Start time:	05:57:23
Start date:	23/04/2025
Path:	C:\Users\user\Desktop\AFPviewer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AFPviewer.exe"
Imagebase:	0xc80000
File size:	4'486'776 bytes
MD5 hash:	8D8006C2C512F23E58772A1AF281409E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

File Created

File Written

File Read

File Attributes Queried

Other File Operations

Device IO

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Value Queried

Key Value Enumerated

Key Enumerated

Show Windows behavior

COM Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

Process Queried

Process Information Set

Show Windows behavior

Thread Activities

Thread Created

Thread Execution Resumed

Thread Delayed

Thread Information Set

Show Windows behavior

Memory Activities

Memory Allocated

Memory Protection Changed

Memory Usage Statistics

Show Windows behavior

System Activities

Language or Locale ID Queried

System Information Queried

Show Windows behavior

Timing Activities

User Timer set

Show Windows behavior

Windows UI Activities

Window Created

Window UI Enumerated

Message Posted to Windows UI

Show Windows behavior

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AFPviewer.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\tmpFC3D.tmp

C:\Users\user\AppData\Local\Temp\tmpFD28.tmp

C:\Users\user\Documents\AFPviewer_Log.txt

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: AFPviewer.exePID: 3464, Parent PID: 2712

General

File Activities

File Opened

File Created

File Written

File Read

Windows Analysis Report
AFPviewer.exe