Analysis Report 0603321WG_0_1 pdf.exe

Overview

General Information

Sample Name: 0603321WG_0_1 pdf.exe
Analysis ID: 356527
MD5: 9844048a2b7081d223139f100b0ff486
SHA1: 1cb465daf8e6a202356db86a9380e94e6cc1fa4d
SHA256: 283915d333318f5e8e7f30cdf8f8f96723da7af6ddab9c29c6f0b5a687157aa4
Tags: AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Binary contains a suspicious time stamp
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE / OLE file has an invalid certificate
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Found malware configuration
Source: 0603321WG_0_1 pdf.exe.4500.7.memstr Malware Configuration Extractor: Agenttesla {"Username: ": "lD7CEXwZN", "URL: ": "http://IScLhfPkYRYa5.com", "To: ": "greatzills@gmail.com", "ByHost: ": "mail.orienttech.com.qa:587", "Password: ": "Y3O4R6toekwlmQ", "From: ": "sales@orienttech.com.qa"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe ReversingLabs: Detection: 21%
Multi AV Scanner detection for submitted file
Source: 0603321WG_0_1 pdf.exe ReversingLabs: Detection: 21%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 0603321WG_0_1 pdf.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 7.2.0603321WG_0_1 pdf.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 28.2.NewApp.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 27.2.NewApp.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: 0603321WG_0_1 pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: 0603321WG_0_1 pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Binary contains paths to debug symbols
Source: Binary string: rsaenh.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670963897.0000000000ED2000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp
Source: Binary string: System.ni.pdb% source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670979775.0000000000EE5000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp, NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000A.00000003.685883855.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829638034.0000000004DE4000.00000004.00000040.sdmp
Source: Binary string: CLBCatQ.pdbse$je source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdbOe@j source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: winnsi.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: clr.pdb source: WerFault.exe, 0000000A.00000003.685883855.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829603052.0000000004DE0000.00000004.00000040.sdmp
Source: Binary string: .ni.pdb source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: cryptsp.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670979775.0000000000EE5000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp, NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbYX&n source: NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdb" source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: CLBCatQ.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: urlmon.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdbF source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: C:\Users\user\Desktop\0603321WG_0_1 pdf.PDB source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670154182.00000000009A7000.00000004.00000010.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: mscorlib.ni.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: rasadhlp.pdbUe:jC source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670979775.0000000000EE5000.00000004.00000020.sdmp, NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670963897.0000000000ED2000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp
Source: Binary string: \??\C:\Users\user\Desktop\0603321WG_0_1 pdf.PDB13 source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670963897.0000000000ED2000.00000004.00000020.sdmp
Source: Binary string: System.Xml.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: CLBCatQ.pdb4 source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: indows.Forms.pdb source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: WLDP.pdb< source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb;^ source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: crypt32.pdbL source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: mscoree.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdbW% source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbN source: NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp
Source: Binary string: psapi.pdb#N source: WerFault.exe, 0000001F.00000003.829483729.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670942444.0000000000EBA000.00000004.00000020.sdmp
Source: Binary string: iertutil.pdbP source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb] source: NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbK source: NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp
Source: Binary string: nsi.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000001F.00000003.829638034.0000000004DE4000.00000004.00000040.sdmp
Source: Binary string: rasadhlp.pdb^ source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: msvcr120_clr0400.i386.pdb% source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: iertutil.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: WLDP.pdbd source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: wintrust.pdbIeNj source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: rasadhlp.pdb. source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: edputil.pdbCeTj source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: msasn1.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbae6je source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670963897.0000000000ED2000.00000004.00000020.sdmp, NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbv source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdb>Y source: NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000A.00000003.685738561.0000000005184000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.832058326.0000000005764000.00000004.00000040.sdmp
Source: Binary string: iVisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670154182.00000000009A7000.00000004.00000010.sdmp, NewApp.exe, 0000000F.00000002.806394877.0000000000FD7000.00000004.00000010.sdmp, NewApp.exe, 00000013.00000002.806993531.0000000000537000.00000004.00000010.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000001F.00000003.806462338.0000000000A21000.00000004.00000001.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb0,J source: NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdbk source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: rasadhlp.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: cldapi.pdbye source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb13Z source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670963897.0000000000ED2000.00000004.00000020.sdmp
Source: Binary string: J0603321WG_0_1 pdf.PDB source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670154182.00000000009A7000.00000004.00000010.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdbV#jN source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp
Source: Binary string: cryptsp.pdbm source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: diasymreader.pdb_ source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: crypt32.pdbme"j source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: }C:\Users\user\AppData\Roaming\NewApp\NewApp.PDB?p source: NewApp.exe, 00000013.00000002.806993531.0000000000537000.00000004.00000010.sdmp
Source: Binary string: mscorlib.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: .pdb, source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670154182.00000000009A7000.00000004.00000010.sdmp
Source: Binary string: rsaenh.pdbk source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: System.Xml.pdb&& source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb% source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: clrjit.pdbu source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000A.00000003.685883855.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829603052.0000000004DE0000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb<Cwo source: NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: fwpuclnt.pdbH source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670979775.0000000000EE5000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.810472818.0000000001543000.00000004.00000020.sdmp, NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: winhttp.pdb6 source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: NewApp.PDBI source: NewApp.exe, 0000000F.00000002.806394877.0000000000FD7000.00000004.00000010.sdmp
Source: Binary string: wimm32.pdbO5 source: WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829603052.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc6.pdbD source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdbh source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb** source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670942444.0000000000EBA000.00000004.00000020.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: iLC:\Windows\Microsoft.VisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670154182.00000000009A7000.00000004.00000010.sdmp, NewApp.exe, 0000000F.00000002.806394877.0000000000FD7000.00000004.00000010.sdmp, NewApp.exe, 00000013.00000002.806993531.0000000000537000.00000004.00000010.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdbT source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: diasymreader.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: winhttp.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: edputil.pdb: source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: Windows.StateRepositoryPS.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdb% source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdb;^ source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdbT3 source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: rtutils.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000001F.00000003.804994756.0000000000A15000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc6.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000A.00000003.685883855.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829603052.0000000004DE0000.00000004.00000040.sdmp
Source: Binary string: WLDP.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: clrjit.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdbg source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdbs source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: winnsi.pdb source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: wmswsock.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: version.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: inaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb1 source: NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp
Source: Binary string: wintrust.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: C:\Users\user\AppData\Roaming\NewApp\NewApp.PDBL source: NewApp.exe, 0000000F.00000002.806394877.0000000000FD7000.00000004.00000010.sdmp
Source: Binary string: System.Xml.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: ore.ni.pdb source: WerFault.exe, 0000001F.00000003.829429051.0000000004E26000.00000004.00000001.sdmp
Source: Binary string: msasn1.pdbb source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: ore.pdb source: WerFault.exe, 0000001F.00000003.829429051.0000000004E26000.00000004.00000001.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000A.00000003.685883855.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829603052.0000000004DE0000.00000004.00000040.sdmp
Source: Binary string: psapi.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdbW% source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: fwpuclnt.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670979775.0000000000EE5000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdby source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: cldapi.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: mscoreei.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000001F.00000003.806548362.0000000000A27000.00000004.00000001.sdmp
Source: Binary string: combase.pdbk source: WerFault.exe, 0000000A.00000003.685738561.0000000005184000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832058326.0000000005764000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: OneCoreUAPCommonProxyStub.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb" source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdb" source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: clrjit.pdb/t)r source: WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: }}NewApp.PDB} source: NewApp.exe, 00000013.00000002.806993531.0000000000537000.00000004.00000010.sdmp
Source: Binary string: edputil.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc.pdb[e<jr source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: crypt32.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://IScLhfPkYRYa5.com
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /base/008D1C43D45C0A742A0D32B591796DBD.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /base/008D1C43D45C0A742A0D32B591796DBD.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /base/008D1C43D45C0A742A0D32B591796DBD.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.71.230 104.21.71.230
Source: global traffic HTTP traffic detected: GET /base/008D1C43D45C0A742A0D32B591796DBD.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /base/008D1C43D45C0A742A0D32B591796DBD.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /base/008D1C43D45C0A742A0D32B591796DBD.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: coroloboxorozor.com
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.913675806.0000000002AC1000.00000004.00000001.sdmp, NewApp.exe, 0000001B.00000002.912580946.0000000003191000.00000004.00000001.sdmp, NewApp.exe, 0000001C.00000002.808427575.0000000003011000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: NewApp.exe, 0000001C.00000002.808427575.0000000003011000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.913675806.0000000002AC1000.00000004.00000001.sdmp, 0603321WG_0_1 pdf.exe, 00000007.00000002.914638851.0000000002E5C000.00000004.00000001.sdmp String found in binary or memory: http://IScLhfPkYRYa5.com
Source: NewApp.exe, 0000001C.00000002.808427575.0000000003011000.00000004.00000001.sdmp String found in binary or memory: http://ajyrmk.com
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.914541829.0000000002E31000.00000004.00000001.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.671188630.0000000002CD1000.00000004.00000001.sdmp, NewApp.exe, 0000000F.00000002.811943679.0000000003221000.00000004.00000001.sdmp, NewApp.exe, 00000013.00000002.811688345.00000000024C1000.00000004.00000001.sdmp String found in binary or memory: http://coroloboxorozor.com
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.671188630.0000000002CD1000.00000004.00000001.sdmp, NewApp.exe, 0000000F.00000002.811943679.0000000003221000.00000004.00000001.sdmp, NewApp.exe, 00000013.00000002.811688345.00000000024C1000.00000004.00000001.sdmp String found in binary or memory: http://coroloboxorozor.com/base/008D1C43D45C0A742A0D32B591796DBD.html
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.914541829.0000000002E31000.00000004.00000001.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.914541829.0000000002E31000.00000004.00000001.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.914541829.0000000002E31000.00000004.00000001.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.914541829.0000000002E31000.00000004.00000001.sdmp String found in binary or memory: http://mail.orienttech.com.qa
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.914541829.0000000002E31000.00000004.00000001.sdmp String found in binary or memory: http://r3.i.lencr.org/0
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.914541829.0000000002E31000.00000004.00000001.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.671188630.0000000002CD1000.00000004.00000001.sdmp, NewApp.exe, 0000000F.00000002.811943679.0000000003221000.00000004.00000001.sdmp, NewApp.exe, 00000013.00000002.811688345.00000000024C1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 0000001F.00000003.824092149.0000000005030000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.913675806.0000000002AC1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%$
Source: NewApp.exe, 0000001C.00000002.808427575.0000000003011000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.679176630.00000000047A2000.00000004.00000001.sdmp, 0603321WG_0_1 pdf.exe, 00000007.00000002.909029563.0000000000402000.00000040.00000001.sdmp, NewApp.exe, 0000000F.00000002.850762818.00000000050CD000.00000004.00000001.sdmp, NewApp.exe, 00000013.00000002.879172967.00000000064E4000.00000004.00000001.sdmp, NewApp.exe, 0000001B.00000002.909001517.0000000000402000.00000040.00000001.sdmp, NewApp.exe, 0000001C.00000002.806272942.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.913675806.0000000002AC1000.00000004.00000001.sdmp, NewApp.exe, 0000001B.00000002.912580946.0000000003191000.00000004.00000001.sdmp, NewApp.exe, 0000001C.00000002.808427575.0000000003011000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: NewApp.exe, 0000000F.00000002.809472540.0000000001498000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary:

barindex
Detected potential crypto function
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 0_2_05C00720 0_2_05C00720
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_00E96830 7_2_00E96830
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_00E95AD0 7_2_00E95AD0
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_00E9E248 7_2_00E9E248
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_00E9B0B9 7_2_00E9B0B9
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_00E9D818 7_2_00E9D818
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_00E9D2AF 7_2_00E9D2AF
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_00E9D397 7_2_00E9D397
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_00E9D723 7_2_00E9D723
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_029146A0 7_2_029146A0
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_029145D0 7_2_029145D0
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_0291D281 7_2_0291D281
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_05F01CC8 7_2_05F01CC8
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_05F00040 7_2_05F00040
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_05F01448 7_2_05F01448
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_05F03340 7_2_05F03340
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_05F03ACC 7_2_05F03ACC
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_05F06E7C 7_2_05F06E7C
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_05F07268 7_2_05F07268
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_05F0A728 7_2_05F0A728
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 27_2_056846A0 27_2_056846A0
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 27_2_056835C4 27_2_056835C4
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 27_2_056845F0 27_2_056845F0
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 27_2_056845B0 27_2_056845B0
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 27_2_05684650 27_2_05684650
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 27_2_05684630 27_2_05684630
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 27_2_05685390 27_2_05685390
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 27_2_0568D281 27_2_0568D281
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 28_2_02FE46A0 28_2_02FE46A0
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 28_2_02FE4672 28_2_02FE4672
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 28_2_02FE4630 28_2_02FE4630
One or more processes crash
Source: unknown Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 276
PE / OLE file has an invalid certificate
Source: 0603321WG_0_1 pdf.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: 0603321WG_0_1 pdf.exe Binary or memory string: OriginalFilename vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.674955398.0000000004485000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameRunPeBraba.dll6 vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.672052071.00000000032A9000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameJcue ESf.exe2 vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.684283950.00000000059F0000.00000002.00000001.sdmp Binary or memory string: originalfilename vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.684283950.00000000059F0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.684453359.0000000005C10000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000000.00000000.643196446.0000000000812000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameUAudJRAa.exe2 vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.683795735.0000000005150000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.684560546.0000000005DB0000.00000002.00000001.sdmp Binary or memory string: System.OriginalFileName vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe Binary or memory string: OriginalFilename vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.920216690.0000000005C60000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.912069890.0000000000FC0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.909029563.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameJcue ESf.exe2 vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.912313952.0000000001030000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamewshom.ocx.mui vs 0603321WG_0_1 pdf.exe
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.909531429.00000000007C2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameUAudJRAa.exe2 vs 0603321WG_0_1 pdf.exe
Uses 32bit PE files
Source: 0603321WG_0_1 pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp Binary or memory string: inaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb1
Source: NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@27/14@4/3
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File created: C:\Users\user\AppData\Roaming\NewApp Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5040:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7056
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6832:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7004
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4972
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD18D.tmp Jump to behavior
Source: 0603321WG_0_1 pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: 0603321WG_0_1 pdf.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File read: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe 'C:\Users\user\Desktop\0603321WG_0_1 pdf.exe'
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: unknown Process created: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe C:\Users\user\Desktop\0603321WG_0_1 pdf.exe
Source: unknown Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 276
Source: unknown Process created: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe 'C:\Users\user\AppData\Roaming\NewApp\NewApp.exe'
Source: unknown Process created: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe 'C:\Users\user\AppData\Roaming\NewApp\NewApp.exe'
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: unknown Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: unknown Process created: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe C:\Users\user\AppData\Roaming\NewApp\NewApp.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe C:\Users\user\AppData\Roaming\NewApp\NewApp.exe
Source: unknown Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7056 -s 1464
Source: unknown Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 1896
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1 Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process created: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process created: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process created: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: 0603321WG_0_1 pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 0603321WG_0_1 pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: rsaenh.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670963897.0000000000ED2000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp
Source: Binary string: System.ni.pdb% source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670979775.0000000000EE5000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp, NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000A.00000003.685883855.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829638034.0000000004DE4000.00000004.00000040.sdmp
Source: Binary string: CLBCatQ.pdbse$je source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdbOe@j source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: winnsi.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: clr.pdb source: WerFault.exe, 0000000A.00000003.685883855.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829603052.0000000004DE0000.00000004.00000040.sdmp
Source: Binary string: .ni.pdb source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: cryptsp.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670979775.0000000000EE5000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp, NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbYX&n source: NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdb" source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: CLBCatQ.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: urlmon.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdbF source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: C:\Users\user\Desktop\0603321WG_0_1 pdf.PDB source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670154182.00000000009A7000.00000004.00000010.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: mscorlib.ni.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: rasadhlp.pdbUe:jC source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670979775.0000000000EE5000.00000004.00000020.sdmp, NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670963897.0000000000ED2000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp
Source: Binary string: \??\C:\Users\user\Desktop\0603321WG_0_1 pdf.PDB13 source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670963897.0000000000ED2000.00000004.00000020.sdmp
Source: Binary string: System.Xml.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: CLBCatQ.pdb4 source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: indows.Forms.pdb source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: WLDP.pdb< source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb;^ source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: crypt32.pdbL source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: mscoree.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdbW% source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbN source: NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp
Source: Binary string: psapi.pdb#N source: WerFault.exe, 0000001F.00000003.829483729.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670942444.0000000000EBA000.00000004.00000020.sdmp
Source: Binary string: iertutil.pdbP source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb] source: NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbK source: NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp
Source: Binary string: nsi.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000001F.00000003.829638034.0000000004DE4000.00000004.00000040.sdmp
Source: Binary string: rasadhlp.pdb^ source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: msvcr120_clr0400.i386.pdb% source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: iertutil.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: WLDP.pdbd source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: wintrust.pdbIeNj source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: rasadhlp.pdb. source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: edputil.pdbCeTj source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: msasn1.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbae6je source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670963897.0000000000ED2000.00000004.00000020.sdmp, NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbv source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdb>Y source: NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000A.00000003.685738561.0000000005184000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.832058326.0000000005764000.00000004.00000040.sdmp
Source: Binary string: iVisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670154182.00000000009A7000.00000004.00000010.sdmp, NewApp.exe, 0000000F.00000002.806394877.0000000000FD7000.00000004.00000010.sdmp, NewApp.exe, 00000013.00000002.806993531.0000000000537000.00000004.00000010.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000001F.00000003.806462338.0000000000A21000.00000004.00000001.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb0,J source: NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdbk source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: rasadhlp.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: cldapi.pdbye source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb13Z source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670963897.0000000000ED2000.00000004.00000020.sdmp
Source: Binary string: J0603321WG_0_1 pdf.PDB source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670154182.00000000009A7000.00000004.00000010.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdbV#jN source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp
Source: Binary string: cryptsp.pdbm source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: diasymreader.pdb_ source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: crypt32.pdbme"j source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: }C:\Users\user\AppData\Roaming\NewApp\NewApp.PDB?p source: NewApp.exe, 00000013.00000002.806993531.0000000000537000.00000004.00000010.sdmp
Source: Binary string: mscorlib.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: .pdb, source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670154182.00000000009A7000.00000004.00000010.sdmp
Source: Binary string: rsaenh.pdbk source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: System.Xml.pdb&& source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb% source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: clrjit.pdbu source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000A.00000003.685883855.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829603052.0000000004DE0000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb<Cwo source: NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: fwpuclnt.pdbH source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670979775.0000000000EE5000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.810472818.0000000001543000.00000004.00000020.sdmp, NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: winhttp.pdb6 source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: NewApp.PDBI source: NewApp.exe, 0000000F.00000002.806394877.0000000000FD7000.00000004.00000010.sdmp
Source: Binary string: wimm32.pdbO5 source: WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829603052.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc6.pdbD source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdbh source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb** source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670942444.0000000000EBA000.00000004.00000020.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: iLC:\Windows\Microsoft.VisualBasic.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670154182.00000000009A7000.00000004.00000010.sdmp, NewApp.exe, 0000000F.00000002.806394877.0000000000FD7000.00000004.00000010.sdmp, NewApp.exe, 00000013.00000002.806993531.0000000000537000.00000004.00000010.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdbT source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: diasymreader.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: winhttp.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: edputil.pdb: source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: Windows.StateRepositoryPS.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdb% source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdb;^ source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdbT3 source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: rtutils.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000001F.00000003.804994756.0000000000A15000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc6.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000A.00000003.685883855.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829603052.0000000004DE0000.00000004.00000040.sdmp
Source: Binary string: WLDP.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: clrjit.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdbg source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdbs source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: winnsi.pdb source: WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp
Source: Binary string: wmswsock.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: version.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: inaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb1 source: NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp
Source: Binary string: wintrust.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: C:\Users\user\AppData\Roaming\NewApp\NewApp.PDBL source: NewApp.exe, 0000000F.00000002.806394877.0000000000FD7000.00000004.00000010.sdmp
Source: Binary string: System.Xml.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: ore.ni.pdb source: WerFault.exe, 0000001F.00000003.829429051.0000000004E26000.00000004.00000001.sdmp
Source: Binary string: msasn1.pdbb source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: NewApp.exe, 00000013.00000002.810490743.000000000088A000.00000004.00000020.sdmp
Source: Binary string: ore.pdb source: WerFault.exe, 0000001F.00000003.829429051.0000000004E26000.00000004.00000001.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000A.00000003.685883855.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.829603052.0000000004DE0000.00000004.00000040.sdmp
Source: Binary string: psapi.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdbW% source: WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: fwpuclnt.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 0603321WG_0_1 pdf.exe, 00000000.00000002.670979775.0000000000EE5000.00000004.00000020.sdmp, NewApp.exe, 0000000F.00000002.810619163.0000000001557000.00000004.00000020.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdby source: WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp
Source: Binary string: cldapi.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: mscoreei.pdb source: WerFault.exe, 0000000A.00000003.685719663.0000000005021000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.829119339.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831487010.0000000005791000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000001F.00000003.806548362.0000000000A27000.00000004.00000001.sdmp
Source: Binary string: combase.pdbk source: WerFault.exe, 0000000A.00000003.685738561.0000000005184000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832058326.0000000005764000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdb source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp
Source: Binary string: OneCoreUAPCommonProxyStub.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000A.00000003.685673735.0000000005187000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828975813.0000000004DE7000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb" source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdb" source: WerFault.exe, 0000001F.00000003.829019707.0000000004DF3000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000002.901213367.0000000004FF0000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: clrjit.pdb/t)r source: WerFault.exe, 00000020.00000003.832350395.0000000005767000.00000004.00000040.sdmp
Source: Binary string: }}NewApp.PDB} source: NewApp.exe, 00000013.00000002.806993531.0000000000537000.00000004.00000010.sdmp
Source: Binary string: edputil.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp
Source: Binary string: dhcpcsvc.pdb[e<jr source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp
Source: Binary string: crypt32.pdb source: WerFault.exe, 0000000A.00000003.685611457.000000000518B000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.828826066.0000000004DEB000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.831025408.000000000576B000.00000004.00000040.sdmp

Data Obfuscation:

barindex
Binary contains a suspicious time stamp
Source: initial sample Static PE information: 0x88460DE1 [Fri Jun 13 17:14:09 2042 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 0_2_05C005E1 push ds; ret 0_2_05C005F4
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 15_2_072B267E pushad ; retf 15_2_072B2681
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Code function: 19_2_077F267F pushad ; retf 19_2_077F2681
Source: initial sample Static PE information: section name: .text entropy: 6.81509040875

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File created: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Jump to dropped file
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NewApp Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NewApp Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File opened: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Window / User API: threadDelayed 480 Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Window / User API: threadDelayed 2830 Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Window / User API: threadDelayed 1055 Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Window / User API: threadDelayed 8763 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Window / User API: threadDelayed 1055 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Window / User API: threadDelayed 2255 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Window / User API: threadDelayed 1512 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Window / User API: threadDelayed 1798 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Window / User API: threadDelayed 1776 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Window / User API: threadDelayed 3515
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Window / User API: threadDelayed 6313
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe TID: 7008 Thread sleep count: 480 > 30 Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe TID: 7008 Thread sleep count: 2830 > 30 Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe TID: 6880 Thread sleep time: -19369081277395017s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe TID: 6868 Thread sleep count: 1055 > 30 Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe TID: 6868 Thread sleep count: 8763 > 30 Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe TID: 6880 Thread sleep count: 40 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe TID: 1380 Thread sleep count: 1055 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe TID: 1380 Thread sleep count: 2255 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe TID: 7048 Thread sleep count: 1512 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe TID: 7048 Thread sleep count: 1798 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe TID: 7048 Thread sleep count: 1776 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe TID: 4532 Thread sleep time: -26747778906878833s >= -30000s
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe TID: 1292 Thread sleep count: 3515 > 30
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe TID: 1292 Thread sleep count: 6313 > 30
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: WerFault.exe, 00000020.00000002.884157462.000000000514C000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW~R]-
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.683795735.0000000005150000.00000002.00000001.sdmp, 0603321WG_0_1 pdf.exe, 00000007.00000002.920216690.0000000005C60000.00000002.00000001.sdmp, WerFault.exe, 0000000A.00000002.701811832.00000000051A0000.00000002.00000001.sdmp, NewApp.exe, 0000000F.00000002.860689934.0000000005840000.00000002.00000001.sdmp, NewApp.exe, 00000013.00000002.861641127.0000000004AE0000.00000002.00000001.sdmp, NewApp.exe, 0000001B.00000002.915125012.0000000006340000.00000002.00000001.sdmp, WerFault.exe, 0000001F.00000002.900651409.0000000004F00000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000000A.00000003.699166386.0000000004BF0000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000002.895985393.00000000009D5000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000002.884157462.000000000514C000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.683795735.0000000005150000.00000002.00000001.sdmp, 0603321WG_0_1 pdf.exe, 00000007.00000002.920216690.0000000005C60000.00000002.00000001.sdmp, WerFault.exe, 0000000A.00000002.701811832.00000000051A0000.00000002.00000001.sdmp, NewApp.exe, 0000000F.00000002.860689934.0000000005840000.00000002.00000001.sdmp, NewApp.exe, 00000013.00000002.861641127.0000000004AE0000.00000002.00000001.sdmp, NewApp.exe, 0000001B.00000002.915125012.0000000006340000.00000002.00000001.sdmp, WerFault.exe, 0000001F.00000002.900651409.0000000004F00000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.683795735.0000000005150000.00000002.00000001.sdmp, 0603321WG_0_1 pdf.exe, 00000007.00000002.920216690.0000000005C60000.00000002.00000001.sdmp, WerFault.exe, 0000000A.00000002.701811832.00000000051A0000.00000002.00000001.sdmp, NewApp.exe, 0000000F.00000002.860689934.0000000005840000.00000002.00000001.sdmp, NewApp.exe, 00000013.00000002.861641127.0000000004AE0000.00000002.00000001.sdmp, NewApp.exe, 0000001B.00000002.915125012.0000000006340000.00000002.00000001.sdmp, WerFault.exe, 0000001F.00000002.900651409.0000000004F00000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.923725606.0000000005F10000.00000004.00000001.sdmp, NewApp.exe, 0000000F.00000002.809881079.00000000014CF000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: WerFault.exe, 0000000A.00000002.701355263.0000000004B74000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW e
Source: 0603321WG_0_1 pdf.exe, 00000000.00000002.683795735.0000000005150000.00000002.00000001.sdmp, 0603321WG_0_1 pdf.exe, 00000007.00000002.920216690.0000000005C60000.00000002.00000001.sdmp, WerFault.exe, 0000000A.00000002.701811832.00000000051A0000.00000002.00000001.sdmp, NewApp.exe, 0000000F.00000002.860689934.0000000005840000.00000002.00000001.sdmp, NewApp.exe, 00000013.00000002.861641127.0000000004AE0000.00000002.00000001.sdmp, NewApp.exe, 0000001B.00000002.915125012.0000000006340000.00000002.00000001.sdmp, WerFault.exe, 0000001F.00000002.900651409.0000000004F00000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Thread information set: HideFromDebugger Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Code function: 7_2_00E90A76 KiUserExceptionDispatcher,WaitForSingleObjectEx,IsWindowArranged,GetGeoInfoW,SetThreadDpiAwarenessContext,KiUserExceptionDispatcher,KiUserExceptionDispatcher,BuildReasonArray,GetPrivateProfileStringA,RecordShutdownReason,GlobalSize,EnableOneCoreTransformMode,GlobalSize,SetFileInformationByHandle,GlobalSize,GlobalSize,EnumDisplayMonitors,GlobalSize,LdrInitializeThunk, 7_2_00E90A76
Enables debug privileges
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Memory written: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Memory written: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Memory written: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1 Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Process created: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process created: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Process created: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.912647673.0000000001420000.00000002.00000001.sdmp, NewApp.exe, 0000001B.00000002.912290547.0000000001C30000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.912647673.0000000001420000.00000002.00000001.sdmp, NewApp.exe, 0000001B.00000002.912290547.0000000001C30000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.912647673.0000000001420000.00000002.00000001.sdmp, NewApp.exe, 0000001B.00000002.912290547.0000000001C30000.00000002.00000001.sdmp Binary or memory string: Progman
Source: 0603321WG_0_1 pdf.exe, 00000007.00000002.912647673.0000000001420000.00000002.00000001.sdmp, NewApp.exe, 0000001B.00000002.912290547.0000000001C30000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\NewApp\NewApp.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 0000000F.00000002.850762818.00000000050CD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.879172967.00000000064E4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.808427575.0000000003011000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.912580946.0000000003191000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.806272942.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.909001517.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.679176630.00000000047A2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.909029563.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.913675806.0000000002AC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.883671585.0000000006979000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: NewApp.exe PID: 4972, type: MEMORY
Source: Yara match File source: Process Memory Space: NewApp.exe PID: 7056, type: MEMORY
Source: Yara match File source: Process Memory Space: NewApp.exe PID: 5552, type: MEMORY
Source: Yara match File source: Process Memory Space: 0603321WG_0_1 pdf.exe PID: 7004, type: MEMORY
Source: Yara match File source: Process Memory Space: 0603321WG_0_1 pdf.exe PID: 4500, type: MEMORY
Source: Yara match File source: 0.2.0603321WG_0_1 pdf.exe.47a2af0.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.NewApp.exe.650ce20.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.0603321WG_0_1 pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.0603321WG_0_1 pdf.exe.47d8910.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.NewApp.exe.6979bd8.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.NewApp.exe.51039d0.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.0603321WG_0_1 pdf.exe.47a2af0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.NewApp.exe.650ce20.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.NewApp.exe.6979bd8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.NewApp.exe.51039d0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.NewApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.NewApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.NewApp.exe.50cdbb0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.0603321WG_0_1 pdf.exe.47d8910.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.NewApp.exe.50cdbb0.8.raw.unpack, type: UNPACKEDPE
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\0603321WG_0_1 pdf.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0000001C.00000002.808427575.0000000003011000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.912580946.0000000003191000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.913675806.0000000002AC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: NewApp.exe PID: 5552, type: MEMORY
Source: Yara match File source: Process Memory Space: 0603321WG_0_1 pdf.exe PID: 4500, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 0000000F.00000002.850762818.00000000050CD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.879172967.00000000064E4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.808427575.0000000003011000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.912580946.0000000003191000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.806272942.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.909001517.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.679176630.00000000047A2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.909029563.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.913675806.0000000002AC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.883671585.0000000006979000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: NewApp.exe PID: 4972, type: MEMORY
Source: Yara match File source: Process Memory Space: NewApp.exe PID: 7056, type: MEMORY
Source: Yara match File source: Process Memory Space: NewApp.exe PID: 5552, type: MEMORY
Source: Yara match File source: Process Memory Space: 0603321WG_0_1 pdf.exe PID: 7004, type: MEMORY
Source: Yara match File source: Process Memory Space: 0603321WG_0_1 pdf.exe PID: 4500, type: MEMORY
Source: Yara match File source: 0.2.0603321WG_0_1 pdf.exe.47a2af0.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.NewApp.exe.650ce20.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.0603321WG_0_1 pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.0603321WG_0_1 pdf.exe.47d8910.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.NewApp.exe.6979bd8.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.NewApp.exe.51039d0.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.0603321WG_0_1 pdf.exe.47a2af0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.NewApp.exe.650ce20.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.NewApp.exe.6979bd8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.NewApp.exe.51039d0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.NewApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.NewApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.NewApp.exe.50cdbb0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.0603321WG_0_1 pdf.exe.47d8910.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.NewApp.exe.50cdbb0.8.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 356527 Sample: 0603321WG_0_1 pdf.exe Startdate: 23/02/2021 Architecture: WINDOWS Score: 100 53 mail.orienttech.com.qa 2->53 69 Found malware configuration 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 Yara detected AgentTesla 2->73 75 5 other signatures 2->75 8 0603321WG_0_1 pdf.exe 15 3 2->8         started        12 NewApp.exe 14 3 2->12         started        14 NewApp.exe 3 2->14         started        signatures3 process4 dnsIp5 57 coroloboxorozor.com 172.67.172.17, 49731, 49763, 80 CLOUDFLARENETUS United States 8->57 77 Hides threads from debuggers 8->77 79 Injects a PE file into a foreign processes 8->79 16 0603321WG_0_1 pdf.exe 2 5 8->16         started        20 cmd.exe 1 8->20         started        22 WerFault.exe 23 9 8->22         started        59 104.21.71.230, 49750, 80 CLOUDFLARENETUS United States 12->59 81 Multi AV Scanner detection for dropped file 12->81 83 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->83 85 Machine Learning detection for dropped file 12->85 87 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 12->87 25 cmd.exe 12->25         started        27 NewApp.exe 12->27         started        29 WerFault.exe 12->29         started        31 cmd.exe 14->31         started        33 NewApp.exe 14->33         started        35 WerFault.exe 14->35         started        signatures6 process7 dnsIp8 49 C:\Users\user\AppData\Roaming\...49ewApp.exe, PE32 16->49 dropped 51 C:\Users\user\...51ewApp.exe:Zone.Identifier, ASCII 16->51 dropped 61 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->61 63 Tries to steal Mail credentials (via file access) 16->63 65 Tries to harvest and steal ftp login credentials 16->65 67 2 other signatures 16->67 37 conhost.exe 20->37         started        39 timeout.exe 1 20->39         started        55 192.168.2.1 unknown unknown 22->55 41 conhost.exe 25->41         started        43 timeout.exe 25->43         started        45 conhost.exe 31->45         started        47 timeout.exe 31->47         started        file9 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.71.230
 unknown United States
13335 CLOUDFLARENETUS false
172.67.172.17
 unknown United States
13335 CLOUDFLARENETUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
mail.orienttech.com.qa 162.241.85.66 true
coroloboxorozor.com 172.67.172.17 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://coroloboxorozor.com/base/008D1C43D45C0A742A0D32B591796DBD.html false
  • Avira URL Cloud: safe
 unknown
http://IScLhfPkYRYa5.com true
  • Avira URL Cloud: safe
 unknown