Windows Analysis Report New_1007572_021.exe

Overview

General Information

Sample Name: New_1007572_021.exe
Analysis ID: 458848
MD5: 41137fd61b9cc0d92225c91660a5902c
SHA1: 15d023fd6d344cb18243469a3ee01fea6bb189af
SHA256: b04306fa8223c20a1abaaa6aeb5cabb2a83dc04337beb2acfd47784b34b682bc
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Found malware configuration
Source: 00000013.00000002.926228324.0000000004F0F000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.domoexpra.club/cg53/"], "decoy": ["sugarlushcosmetic.com", "a2net.info", "ximakaya.com", "thevochick.com", "khafto.com", "zsgpbgsbh.icu", "psm-gen.com", "jhxhotei.com", "7991899.com", "nda.today", "fourseasonsvanlines.com", "splediferous.info", "thesqlgoth.com", "newpathequine.com", "advan.digital", "skamanderboats.com", "thejnit.com", "pardusarms.net", "mevasoluciones.com", "biggdogg5n2.com", "anogirl.com", "xinyisanreqi.com", "2mothertruckers.net", "phongvevic.com", "atmosphere.rent", "amabie-net.com", "stocksp24.com", "starseedbeing.com", "icreditmalaysia.com", "inochinokagayaki.net", "christianbooktrailer.com", "gidrot.com", "junglecli.com", "greenportcivic.com", "beyondparenting101.com", "tracisolomon.xyz", "healinghandssalem.com", "hackersincgolf.com", "goselling.solutions", "cumuluspharma.com", "ramblecollections.com", "mac-marine.com", "likeit21.com", "gdlejing.com", "si600.net", "greenhearthome.com", "tourps.com", "lvyi19.com", "frequent420.com", "goodteattirerebates.com", "melanie-gore.com", "comfsresidential.com", "vrgkk.com", "losmaestrosencarpinteria.com", "nikhitaindustries.com", "fresgolens.online", "xpj777.life", "zerkalo-mr-bit-casino.com", "thorsensgrinding.com", "ronniethemole.com", "poundlove.com", "joansv.com", "finneyplace.com", "dakotacntr.com"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Metadefender: Detection: 45% Perma Link
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe ReversingLabs: Detection: 85%
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe ReversingLabs: Detection: 28%
Multi AV Scanner detection for submitted file
Source: New_1007572_021.exe ReversingLabs: Detection: 28%
Yara detected FormBook
Source: Yara match File source: 0.2.New_1007572_021.exe.3eb8b30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.New_1007572_021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3bc9930.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3d7bea0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3d06480.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.926228324.0000000004F0F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925005416.0000000000278000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821727953.0000000001081000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821846658.00000000012B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.740535210.0000000000404000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925127682.0000000000490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.926114786.0000000004BA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821488799.0000000000E10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925530735.00000000031B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739038576.0000000003BCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.740219963.0000000001081000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739831969.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739343756.0000000003D06000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe, type: DROPPED
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: New_1007572_021.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 0.2.New_1007572_021.exe.2d49d5c.1.unpack Avira: Label: TR/Dropper.Gen
Source: 0.2.New_1007572_021.exe.3eb8b30.6.unpack Avira: Label: TR/Crypt.XPACK.Gen2
Source: 10.2.FB_5E87.tmp.exe.1080000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 10.0.FB_5E87.tmp.exe.1080000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 8.2.New_1007572_021.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.New_1007572_021.exe.3bc9930.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: New_1007572_021.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: New_1007572_021.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cscript.pdbUGP source: FB_5E87.tmp.exe, 0000000A.00000002.823189585.00000000032C0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 0000000B.00000000.765998733.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: FB_5E87.tmp.exe, 0000000A.00000002.822175695.00000000013F0000.00000040.00000001.sdmp, cscript.exe, 00000013.00000002.925842696.000000000498F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: FB_5E87.tmp.exe, 0000000A.00000002.822175695.00000000013F0000.00000040.00000001.sdmp, cscript.exe
Source: Binary string: cscript.pdb source: FB_5E87.tmp.exe, 0000000A.00000002.823189585.00000000032C0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 0000000B.00000000.765998733.0000000005A00000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 4x nop then pop esi 10_2_0109727D
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 4x nop then pop edi 10_2_01097D7B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 4x nop then pop esi 19_2_031C727D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 4x nop then pop edi 19_2_031C7D7B

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.domoexpra.club/cg53/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /cg53/?y48=RnXd-dV8&04VdoL_=jL4gYOGdbdGLgCuh81HWgUyhq6g08d9KQ1n+auYX12/KRBTZXwpphFOeP1KBAJVgFN6h HTTP/1.1Host: www.comfsresidential.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TEAMINTERNET-ASDE TEAMINTERNET-ASDE
Source: global traffic HTTP traffic detected: GET /cg53/?y48=RnXd-dV8&04VdoL_=jL4gYOGdbdGLgCuh81HWgUyhq6g08d9KQ1n+auYX12/KRBTZXwpphFOeP1KBAJVgFN6h HTTP/1.1Host: www.comfsresidential.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.comfsresidential.com
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 0000000B.00000000.785548112.0000000002B50000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: New_1007572_021.exe, 00000000.00000002.738485693.00000000012F7000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: New_1007572_021.exe, 00000000.00000002.738485693.00000000012F7000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.come.comE
Source: New_1007572_021.exe, 00000000.00000002.738485693.00000000012F7000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.comiona
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: New_1007572_021.exe, 00000000.00000002.742817796.0000000005BA0000.00000002.00000001.sdmp, explorer.exe, 0000000B.00000000.774582280.000000000B970000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: New_1007572_021.exe, 00000000.00000002.737740321.00000000010B0000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 0.2.New_1007572_021.exe.3eb8b30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.New_1007572_021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3bc9930.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3d7bea0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3d06480.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.926228324.0000000004F0F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925005416.0000000000278000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821727953.0000000001081000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821846658.00000000012B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.740535210.0000000000404000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925127682.0000000000490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.926114786.0000000004BA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821488799.0000000000E10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925530735.00000000031B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739038576.0000000003BCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.740219963.0000000001081000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739831969.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739343756.0000000003D06000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe, type: DROPPED

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.New_1007572_021.exe.3eb8b30.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.New_1007572_021.exe.3eb8b30.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 10.2.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 10.0.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 10.0.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 8.2.New_1007572_021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.2.New_1007572_021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.New_1007572_021.exe.3bc9930.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.New_1007572_021.exe.3bc9930.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.New_1007572_021.exe.3d7bea0.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.New_1007572_021.exe.3d7bea0.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.New_1007572_021.exe.3d06480.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.New_1007572_021.exe.3d06480.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.926228324.0000000004F0F000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.926228324.0000000004F0F000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.925005416.0000000000278000.00000004.00000020.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.925005416.0000000000278000.00000004.00000020.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.821727953.0000000001081000.00000020.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.821727953.0000000001081000.00000020.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.821846658.00000000012B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.821846658.00000000012B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.740535210.0000000000404000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.740535210.0000000000404000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.925127682.0000000000490000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.925127682.0000000000490000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.926114786.0000000004BA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.926114786.0000000004BA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.821488799.0000000000E10000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.821488799.0000000000E10000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.925530735.00000000031B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.925530735.00000000031B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.739038576.0000000003BCD000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.739038576.0000000003BCD000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.740219963.0000000001081000.00000020.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000000.740219963.0000000001081000.00000020.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.739831969.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.739831969.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.739343756.0000000003D06000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.739343756.0000000003D06000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe, type: DROPPED Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe, type: DROPPED Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109A100 NtAllocateVirtualMemory, 10_2_0109A100
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109A050 NtClose, 10_2_0109A050
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01099F20 NtCreateFile, 10_2_01099F20
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01099FD0 NtReadFile, 10_2_01099FD0
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109A04C NtClose, 10_2_0109A04C
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109A0FA NtAllocateVirtualMemory, 10_2_0109A0FA
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01099F1A NtCreateFile, 10_2_01099F1A
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01099FCA NtReadFile, 10_2_01099FCA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D95D0 NtClose,LdrInitializeThunk, 19_2_048D95D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9540 NtReadFile,LdrInitializeThunk, 19_2_048D9540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D96D0 NtCreateKey,LdrInitializeThunk, 19_2_048D96D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D96E0 NtFreeVirtualMemory,LdrInitializeThunk, 19_2_048D96E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9650 NtQueryValueKey,LdrInitializeThunk, 19_2_048D9650
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9660 NtAllocateVirtualMemory,LdrInitializeThunk, 19_2_048D9660
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9780 NtMapViewOfSection,LdrInitializeThunk, 19_2_048D9780
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9FE0 NtCreateMutant,LdrInitializeThunk, 19_2_048D9FE0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9710 NtQueryInformationToken,LdrInitializeThunk, 19_2_048D9710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9840 NtDelayExecution,LdrInitializeThunk, 19_2_048D9840
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9860 NtQuerySystemInformation,LdrInitializeThunk, 19_2_048D9860
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D99A0 NtCreateSection,LdrInitializeThunk, 19_2_048D99A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 19_2_048D9910
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9A50 NtCreateFile,LdrInitializeThunk, 19_2_048D9A50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D95F0 NtQueryInformationFile, 19_2_048D95F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9520 NtWaitForSingleObject, 19_2_048D9520
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048DAD30 NtSetContextThread, 19_2_048DAD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9560 NtWriteFile, 19_2_048D9560
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9610 NtEnumerateValueKey, 19_2_048D9610
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9670 NtQueryInformationProcess, 19_2_048D9670
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D97A0 NtUnmapViewOfSection, 19_2_048D97A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048DA710 NtOpenProcessToken, 19_2_048DA710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9730 NtQueryVirtualMemory, 19_2_048D9730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9760 NtOpenProcess, 19_2_048D9760
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048DA770 NtOpenThread, 19_2_048DA770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9770 NtSetInformationFile, 19_2_048D9770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D98A0 NtWriteVirtualMemory, 19_2_048D98A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D98F0 NtReadVirtualMemory, 19_2_048D98F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9820 NtEnumerateKey, 19_2_048D9820
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048DB040 NtSuspendThread, 19_2_048DB040
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D99D0 NtCreateProcessEx, 19_2_048D99D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9950 NtQueueApcThread, 19_2_048D9950
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9A80 NtOpenDirectoryObject, 19_2_048D9A80
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9A00 NtProtectVirtualMemory, 19_2_048D9A00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9A10 NtQuerySection, 19_2_048D9A10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9A20 NtResumeThread, 19_2_048D9A20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048DA3B0 NtGetContextThread, 19_2_048DA3B0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D9B00 NtSetValueKey, 19_2_048D9B00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CA100 NtAllocateVirtualMemory, 19_2_031CA100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CA050 NtClose, 19_2_031CA050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031C9F20 NtCreateFile, 19_2_031C9F20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031C9FD0 NtReadFile, 19_2_031C9FD0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CA04C NtClose, 19_2_031CA04C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CA0FA NtAllocateVirtualMemory, 19_2_031CA0FA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031C9F1A NtCreateFile, 19_2_031C9F1A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031C9FCA NtReadFile, 19_2_031C9FCA
Detected potential crypto function
Source: C:\Users\user\Desktop\New_1007572_021.exe Code function: 0_2_0109E494 0_2_0109E494
Source: C:\Users\user\Desktop\New_1007572_021.exe Code function: 0_2_0109F580 0_2_0109F580
Source: C:\Users\user\Desktop\New_1007572_021.exe Code function: 0_2_0109F590 0_2_0109F590
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109D166 10_2_0109D166
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01081030 10_2_01081030
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109E376 10_2_0109E376
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01082D90 10_2_01082D90
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109D773 10_2_0109D773
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109BFA6 10_2_0109BFA6
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01082FB0 10_2_01082FB0
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01089E30 10_2_01089E30
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109E6D5 10_2_0109E6D5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A841F 19_2_048A841F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495D466 19_2_0495D466
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C2581 19_2_048C2581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049625DD 19_2_049625DD
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AD5E0 19_2_048AD5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04962D07 19_2_04962D07
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04890D20 19_2_04890D20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04961D55 19_2_04961D55
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04962EF7 19_2_04962EF7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495D616 19_2_0495D616
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B6E30 19_2_048B6E30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04961FF1 19_2_04961FF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AB090 19_2_048AB090
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C20A0 19_2_048C20A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049620A8 19_2_049620A8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049628EC 19_2_049628EC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951002 19_2_04951002
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489F900 19_2_0489F900
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B4120 19_2_048B4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049622AE 19_2_049622AE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CEBB0 19_2_048CEBB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495DBD2 19_2_0495DBD2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04962B28 19_2_04962B28
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CE376 19_2_031CE376
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CD166 19_2_031CD166
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CD773 19_2_031CD773
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031B2FB0 19_2_031B2FB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CBFA6 19_2_031CBFA6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031B9E30 19_2_031B9E30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CE6D5 19_2_031CE6D5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031B2D90 19_2_031B2D90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\cscript.exe Code function: String function: 0489B150 appears 35 times
PE file contains strange resources
Source: FB_5908.tmp.exe.8.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
PE file does not import any functions
Source: FB_5908.tmp.exe.8.dr Static PE information: No import functions for PE file found
Source: FB_5E87.tmp.exe.8.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: New_1007572_021.exe, 00000000.00000002.747317256.0000000007940000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameYyezikludvdagjmvrozekhz.dll" vs New_1007572_021.exe
Source: New_1007572_021.exe, 00000000.00000002.746272769.0000000007420000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs New_1007572_021.exe
Source: New_1007572_021.exe, 00000000.00000002.738790533.0000000002C7C000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameclrjit.dllT vs New_1007572_021.exe
Source: New_1007572_021.exe, 00000000.00000002.738790533.0000000002C7C000.00000004.00000001.sdmp Binary or memory string: OriginalFilename vs New_1007572_021.exe
Source: New_1007572_021.exe, 00000000.00000002.737740321.00000000010B0000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs New_1007572_021.exe
Source: New_1007572_021.exe, 00000000.00000002.739038576.0000000003BCD000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameBindStub.exe vs New_1007572_021.exe
Source: New_1007572_021.exe, 00000008.00000002.740535210.0000000000404000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameBindStub.exe vs New_1007572_021.exe
Source: New_1007572_021.exe, 00000008.00000002.743239571.0000000002FD0000.00000002.00000001.sdmp Binary or memory string: System.OriginalFileName vs New_1007572_021.exe
Uses 32bit PE files
Source: New_1007572_021.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 0.2.New_1007572_021.exe.3eb8b30.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.New_1007572_021.exe.3eb8b30.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 10.2.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 10.2.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 10.0.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 10.0.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 8.2.New_1007572_021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.2.New_1007572_021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.New_1007572_021.exe.3bc9930.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.New_1007572_021.exe.3bc9930.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.New_1007572_021.exe.3d7bea0.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.New_1007572_021.exe.3d7bea0.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.New_1007572_021.exe.3d06480.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.New_1007572_021.exe.3d06480.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.926228324.0000000004F0F000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.926228324.0000000004F0F000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.925005416.0000000000278000.00000004.00000020.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.925005416.0000000000278000.00000004.00000020.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.821727953.0000000001081000.00000020.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.821727953.0000000001081000.00000020.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.821846658.00000000012B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.821846658.00000000012B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.740535210.0000000000404000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.740535210.0000000000404000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.925127682.0000000000490000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.925127682.0000000000490000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.926114786.0000000004BA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.926114786.0000000004BA0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.821488799.0000000000E10000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.821488799.0000000000E10000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.925530735.00000000031B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.925530735.00000000031B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.739038576.0000000003BCD000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.739038576.0000000003BCD000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.740219963.0000000001081000.00000020.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000000.740219963.0000000001081000.00000020.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.739831969.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.739831969.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.739343756.0000000003D06000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.739343756.0000000003D06000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe, type: DROPPED Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe, type: DROPPED Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: New_1007572_021.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: New_1007572_021.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: FB_5E87.tmp.exe.8.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: FB_5E87.tmp.exe.8.dr Static PE information: Section .text
Source: classification engine Classification label: mal100.troj.evad.winEXE@11/5@1/2
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Code function: 8_2_00401000 FindResourceA,SizeofResource,LoadResource,LockResource,GetTempPathA,GetTempFileNameA,MoveFileExA,MoveFileExA,sprintf,CreateFileA,WriteFile,CloseHandle,ShellExecuteA,FreeResource,MoveFileExA,ExitProcess, 8_2_00401000
Source: C:\Users\user\Desktop\New_1007572_021.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New_1007572_021.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_01
Source: C:\Users\user\Desktop\New_1007572_021.exe File created: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Jump to behavior
Source: New_1007572_021.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\New_1007572_021.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: New_1007572_021.exe ReversingLabs: Detection: 28%
Source: C:\Users\user\Desktop\New_1007572_021.exe File read: C:\Users\user\Desktop\New_1007572_021.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\New_1007572_021.exe 'C:\Users\user\Desktop\New_1007572_021.exe'
Source: C:\Users\user\Desktop\New_1007572_021.exe Process created: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe C:\Users\user\AppData\Local\Temp\New_1007572_021.exe
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Process created: C:\Users\user\AppData\Local\Temp\FB_5908.tmp.exe 'C:\Users\user\AppData\Local\Temp\FB_5908.tmp.exe'
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Process created: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe 'C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cscript.exe
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\New_1007572_021.exe Process created: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Process created: C:\Users\user\AppData\Local\Temp\FB_5908.tmp.exe 'C:\Users\user\AppData\Local\Temp\FB_5908.tmp.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Process created: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe 'C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\New_1007572_021.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: New_1007572_021.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: New_1007572_021.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cscript.pdbUGP source: FB_5E87.tmp.exe, 0000000A.00000002.823189585.00000000032C0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 0000000B.00000000.765998733.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: FB_5E87.tmp.exe, 0000000A.00000002.822175695.00000000013F0000.00000040.00000001.sdmp, cscript.exe, 00000013.00000002.925842696.000000000498F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: FB_5E87.tmp.exe, 0000000A.00000002.822175695.00000000013F0000.00000040.00000001.sdmp, cscript.exe
Source: Binary string: cscript.pdb source: FB_5E87.tmp.exe, 0000000A.00000002.823189585.00000000032C0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 0000000B.00000000.765998733.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: New_1007572_021.exe, Cwzjibiwy.Expressions/SetterIdentifierExpression.cs .Net Code: SelectInitializer System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: New_1007572_021.exe.0.dr, Cwzjibiwy.Expressions/SetterIdentifierExpression.cs .Net Code: SelectInitializer System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.New_1007572_021.exe.800000.0.unpack, Cwzjibiwy.Expressions/SetterIdentifierExpression.cs .Net Code: SelectInitializer System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.New_1007572_021.exe.800000.0.unpack, Cwzjibiwy.Expressions/SetterIdentifierExpression.cs .Net Code: SelectInitializer System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 8.0.New_1007572_021.exe.b50000.0.unpack, Cwzjibiwy.Expressions/SetterIdentifierExpression.cs .Net Code: SelectInitializer System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 8.2.New_1007572_021.exe.b50000.1.unpack, Cwzjibiwy.Expressions/SetterIdentifierExpression.cs .Net Code: SelectInitializer System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Binary contains a suspicious time stamp
Source: New_1007572_021.exe Static PE information: 0xDF29736D [Sun Aug 22 17:54:53 2088 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109D12C push eax; ret 10_2_0109D132
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01097140 push edi; retf 10_2_01097160
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109D166 push dword ptr [CCC28DB9h]; ret 10_2_0109D772
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01097814 push eax; retf 10_2_0109781A
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109784D push eax; retf 10_2_0109781A
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109D075 push eax; ret 10_2_0109D0C8
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109D0CB push eax; ret 10_2_0109D132
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109D0C2 push eax; ret 10_2_0109D0C8
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0108EDBC push edx; retf 10_2_0108EDBF
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109C443 push eax; iretd 10_2_0109C44B
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109E4EE push ds; iretd 10_2_0109E4EF
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0109D773 push dword ptr [CCC28DB9h]; ret 10_2_0109D772
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048ED0D1 push ecx; ret 19_2_048ED0E4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CD12C push eax; ret 19_2_031CD132
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031C7140 push edi; retf 19_2_031C7160
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CD166 push dword ptr [CCC28DB9h]; ret 19_2_031CD772
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031C7814 push eax; retf 19_2_031C781A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031C784D push eax; retf 19_2_031C781A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CD075 push eax; ret 19_2_031CD0C8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CD0CB push eax; ret 19_2_031CD132
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CD0C2 push eax; ret 19_2_031CD0C8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CD773 push dword ptr [CCC28DB9h]; ret 19_2_031CD772
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031BEDBC push edx; retf 19_2_031BEDBF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CC443 push eax; iretd 19_2_031CC44B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_031CE4EE push ds; iretd 19_2_031CE4EF
Source: initial sample Static PE information: section name: .text entropy: 7.98710710749
Source: initial sample Static PE information: section name: .text entropy: 7.98710710749
Source: initial sample Static PE information: section name: .text entropy: 7.40373413401

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe File created: C:\Users\user\AppData\Local\Temp\FB_5908.tmp.exe Jump to dropped file
Source: C:\Users\user\Desktop\New_1007572_021.exe File created: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe File created: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8C 0xCE 0xEF
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe RDTSC instruction interceptor: First address: 00000000010898E4 second address: 00000000010898EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe RDTSC instruction interceptor: First address: 0000000001089B4E second address: 0000000001089B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 00000000031B98E4 second address: 00000000031B98EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 00000000031B9B4E second address: 00000000031B9B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01089A80 rdtsc 10_2_01089A80
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\New_1007572_021.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\New_1007572_021.exe TID: 6716 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cscript.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\New_1007572_021.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 0000000B.00000000.798630799.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 0000000B.00000000.771534648.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000000.767000909.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000000.771534648.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000000.771670358.000000000A716000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 0000000B.00000000.760088803.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 0000000B.00000000.798630799.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 0000000B.00000000.771670358.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 0000000B.00000000.798630799.00000000058C0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 0000000B.00000000.771670358.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 0000000B.00000000.798630799.00000000058C0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\New_1007572_021.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_01089A80 rdtsc 10_2_01089A80
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Code function: 10_2_0108ACC0 LdrLoadDll, 10_2_0108ACC0
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A849B mov eax, dword ptr fs:[00000030h] 19_2_048A849B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04968CD6 mov eax, dword ptr fs:[00000030h] 19_2_04968CD6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916CF0 mov eax, dword ptr fs:[00000030h] 19_2_04916CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916CF0 mov eax, dword ptr fs:[00000030h] 19_2_04916CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916CF0 mov eax, dword ptr fs:[00000030h] 19_2_04916CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049514FB mov eax, dword ptr fs:[00000030h] 19_2_049514FB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951C06 mov eax, dword ptr fs:[00000030h] 19_2_04951C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0496740D mov eax, dword ptr fs:[00000030h] 19_2_0496740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0496740D mov eax, dword ptr fs:[00000030h] 19_2_0496740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0496740D mov eax, dword ptr fs:[00000030h] 19_2_0496740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916C0A mov eax, dword ptr fs:[00000030h] 19_2_04916C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916C0A mov eax, dword ptr fs:[00000030h] 19_2_04916C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916C0A mov eax, dword ptr fs:[00000030h] 19_2_04916C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916C0A mov eax, dword ptr fs:[00000030h] 19_2_04916C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CBC2C mov eax, dword ptr fs:[00000030h] 19_2_048CBC2C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492C450 mov eax, dword ptr fs:[00000030h] 19_2_0492C450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492C450 mov eax, dword ptr fs:[00000030h] 19_2_0492C450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CA44B mov eax, dword ptr fs:[00000030h] 19_2_048CA44B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B746D mov eax, dword ptr fs:[00000030h] 19_2_048B746D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04892D8A mov eax, dword ptr fs:[00000030h] 19_2_04892D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04892D8A mov eax, dword ptr fs:[00000030h] 19_2_04892D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04892D8A mov eax, dword ptr fs:[00000030h] 19_2_04892D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04892D8A mov eax, dword ptr fs:[00000030h] 19_2_04892D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04892D8A mov eax, dword ptr fs:[00000030h] 19_2_04892D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C2581 mov eax, dword ptr fs:[00000030h] 19_2_048C2581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C2581 mov eax, dword ptr fs:[00000030h] 19_2_048C2581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C2581 mov eax, dword ptr fs:[00000030h] 19_2_048C2581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C2581 mov eax, dword ptr fs:[00000030h] 19_2_048C2581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CFD9B mov eax, dword ptr fs:[00000030h] 19_2_048CFD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CFD9B mov eax, dword ptr fs:[00000030h] 19_2_048CFD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C35A1 mov eax, dword ptr fs:[00000030h] 19_2_048C35A1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C1DB5 mov eax, dword ptr fs:[00000030h] 19_2_048C1DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C1DB5 mov eax, dword ptr fs:[00000030h] 19_2_048C1DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C1DB5 mov eax, dword ptr fs:[00000030h] 19_2_048C1DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049605AC mov eax, dword ptr fs:[00000030h] 19_2_049605AC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049605AC mov eax, dword ptr fs:[00000030h] 19_2_049605AC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916DC9 mov eax, dword ptr fs:[00000030h] 19_2_04916DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916DC9 mov eax, dword ptr fs:[00000030h] 19_2_04916DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916DC9 mov eax, dword ptr fs:[00000030h] 19_2_04916DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916DC9 mov ecx, dword ptr fs:[00000030h] 19_2_04916DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916DC9 mov eax, dword ptr fs:[00000030h] 19_2_04916DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04916DC9 mov eax, dword ptr fs:[00000030h] 19_2_04916DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04948DF1 mov eax, dword ptr fs:[00000030h] 19_2_04948DF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AD5E0 mov eax, dword ptr fs:[00000030h] 19_2_048AD5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AD5E0 mov eax, dword ptr fs:[00000030h] 19_2_048AD5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495FDE2 mov eax, dword ptr fs:[00000030h] 19_2_0495FDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495FDE2 mov eax, dword ptr fs:[00000030h] 19_2_0495FDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495FDE2 mov eax, dword ptr fs:[00000030h] 19_2_0495FDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495FDE2 mov eax, dword ptr fs:[00000030h] 19_2_0495FDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04968D34 mov eax, dword ptr fs:[00000030h] 19_2_04968D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0491A537 mov eax, dword ptr fs:[00000030h] 19_2_0491A537
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495E539 mov eax, dword ptr fs:[00000030h] 19_2_0495E539
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C4D3B mov eax, dword ptr fs:[00000030h] 19_2_048C4D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C4D3B mov eax, dword ptr fs:[00000030h] 19_2_048C4D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C4D3B mov eax, dword ptr fs:[00000030h] 19_2_048C4D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489AD30 mov eax, dword ptr fs:[00000030h] 19_2_0489AD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A3D34 mov eax, dword ptr fs:[00000030h] 19_2_048A3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D3D43 mov eax, dword ptr fs:[00000030h] 19_2_048D3D43
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04913540 mov eax, dword ptr fs:[00000030h] 19_2_04913540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B7D50 mov eax, dword ptr fs:[00000030h] 19_2_048B7D50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BC577 mov eax, dword ptr fs:[00000030h] 19_2_048BC577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BC577 mov eax, dword ptr fs:[00000030h] 19_2_048BC577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492FE87 mov eax, dword ptr fs:[00000030h] 19_2_0492FE87
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04960EA5 mov eax, dword ptr fs:[00000030h] 19_2_04960EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04960EA5 mov eax, dword ptr fs:[00000030h] 19_2_04960EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04960EA5 mov eax, dword ptr fs:[00000030h] 19_2_04960EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049146A7 mov eax, dword ptr fs:[00000030h] 19_2_049146A7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04968ED6 mov eax, dword ptr fs:[00000030h] 19_2_04968ED6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C36CC mov eax, dword ptr fs:[00000030h] 19_2_048C36CC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D8EC7 mov eax, dword ptr fs:[00000030h] 19_2_048D8EC7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0494FEC0 mov eax, dword ptr fs:[00000030h] 19_2_0494FEC0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A76E2 mov eax, dword ptr fs:[00000030h] 19_2_048A76E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C16E0 mov ecx, dword ptr fs:[00000030h] 19_2_048C16E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489C600 mov eax, dword ptr fs:[00000030h] 19_2_0489C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489C600 mov eax, dword ptr fs:[00000030h] 19_2_0489C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489C600 mov eax, dword ptr fs:[00000030h] 19_2_0489C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C8E00 mov eax, dword ptr fs:[00000030h] 19_2_048C8E00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CA61C mov eax, dword ptr fs:[00000030h] 19_2_048CA61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CA61C mov eax, dword ptr fs:[00000030h] 19_2_048CA61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04951608 mov eax, dword ptr fs:[00000030h] 19_2_04951608
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489E620 mov eax, dword ptr fs:[00000030h] 19_2_0489E620
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0494FE3F mov eax, dword ptr fs:[00000030h] 19_2_0494FE3F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A7E41 mov eax, dword ptr fs:[00000030h] 19_2_048A7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A7E41 mov eax, dword ptr fs:[00000030h] 19_2_048A7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A7E41 mov eax, dword ptr fs:[00000030h] 19_2_048A7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A7E41 mov eax, dword ptr fs:[00000030h] 19_2_048A7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A7E41 mov eax, dword ptr fs:[00000030h] 19_2_048A7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A7E41 mov eax, dword ptr fs:[00000030h] 19_2_048A7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495AE44 mov eax, dword ptr fs:[00000030h] 19_2_0495AE44
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495AE44 mov eax, dword ptr fs:[00000030h] 19_2_0495AE44
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A766D mov eax, dword ptr fs:[00000030h] 19_2_048A766D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BAE73 mov eax, dword ptr fs:[00000030h] 19_2_048BAE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BAE73 mov eax, dword ptr fs:[00000030h] 19_2_048BAE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BAE73 mov eax, dword ptr fs:[00000030h] 19_2_048BAE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BAE73 mov eax, dword ptr fs:[00000030h] 19_2_048BAE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BAE73 mov eax, dword ptr fs:[00000030h] 19_2_048BAE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04917794 mov eax, dword ptr fs:[00000030h] 19_2_04917794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04917794 mov eax, dword ptr fs:[00000030h] 19_2_04917794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04917794 mov eax, dword ptr fs:[00000030h] 19_2_04917794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A8794 mov eax, dword ptr fs:[00000030h] 19_2_048A8794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D37F5 mov eax, dword ptr fs:[00000030h] 19_2_048D37F5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492FF10 mov eax, dword ptr fs:[00000030h] 19_2_0492FF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492FF10 mov eax, dword ptr fs:[00000030h] 19_2_0492FF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CA70E mov eax, dword ptr fs:[00000030h] 19_2_048CA70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CA70E mov eax, dword ptr fs:[00000030h] 19_2_048CA70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0496070D mov eax, dword ptr fs:[00000030h] 19_2_0496070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0496070D mov eax, dword ptr fs:[00000030h] 19_2_0496070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BF716 mov eax, dword ptr fs:[00000030h] 19_2_048BF716
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04894F2E mov eax, dword ptr fs:[00000030h] 19_2_04894F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04894F2E mov eax, dword ptr fs:[00000030h] 19_2_04894F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CE730 mov eax, dword ptr fs:[00000030h] 19_2_048CE730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AEF40 mov eax, dword ptr fs:[00000030h] 19_2_048AEF40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AFF60 mov eax, dword ptr fs:[00000030h] 19_2_048AFF60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04968F6A mov eax, dword ptr fs:[00000030h] 19_2_04968F6A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04899080 mov eax, dword ptr fs:[00000030h] 19_2_04899080
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04913884 mov eax, dword ptr fs:[00000030h] 19_2_04913884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04913884 mov eax, dword ptr fs:[00000030h] 19_2_04913884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D90AF mov eax, dword ptr fs:[00000030h] 19_2_048D90AF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C20A0 mov eax, dword ptr fs:[00000030h] 19_2_048C20A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C20A0 mov eax, dword ptr fs:[00000030h] 19_2_048C20A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C20A0 mov eax, dword ptr fs:[00000030h] 19_2_048C20A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C20A0 mov eax, dword ptr fs:[00000030h] 19_2_048C20A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C20A0 mov eax, dword ptr fs:[00000030h] 19_2_048C20A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C20A0 mov eax, dword ptr fs:[00000030h] 19_2_048C20A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CF0BF mov ecx, dword ptr fs:[00000030h] 19_2_048CF0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CF0BF mov eax, dword ptr fs:[00000030h] 19_2_048CF0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CF0BF mov eax, dword ptr fs:[00000030h] 19_2_048CF0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492B8D0 mov eax, dword ptr fs:[00000030h] 19_2_0492B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492B8D0 mov ecx, dword ptr fs:[00000030h] 19_2_0492B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492B8D0 mov eax, dword ptr fs:[00000030h] 19_2_0492B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492B8D0 mov eax, dword ptr fs:[00000030h] 19_2_0492B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492B8D0 mov eax, dword ptr fs:[00000030h] 19_2_0492B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0492B8D0 mov eax, dword ptr fs:[00000030h] 19_2_0492B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048958EC mov eax, dword ptr fs:[00000030h] 19_2_048958EC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04964015 mov eax, dword ptr fs:[00000030h] 19_2_04964015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04964015 mov eax, dword ptr fs:[00000030h] 19_2_04964015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04917016 mov eax, dword ptr fs:[00000030h] 19_2_04917016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04917016 mov eax, dword ptr fs:[00000030h] 19_2_04917016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04917016 mov eax, dword ptr fs:[00000030h] 19_2_04917016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AB02A mov eax, dword ptr fs:[00000030h] 19_2_048AB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AB02A mov eax, dword ptr fs:[00000030h] 19_2_048AB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AB02A mov eax, dword ptr fs:[00000030h] 19_2_048AB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AB02A mov eax, dword ptr fs:[00000030h] 19_2_048AB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C002D mov eax, dword ptr fs:[00000030h] 19_2_048C002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C002D mov eax, dword ptr fs:[00000030h] 19_2_048C002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C002D mov eax, dword ptr fs:[00000030h] 19_2_048C002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C002D mov eax, dword ptr fs:[00000030h] 19_2_048C002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C002D mov eax, dword ptr fs:[00000030h] 19_2_048C002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B0050 mov eax, dword ptr fs:[00000030h] 19_2_048B0050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B0050 mov eax, dword ptr fs:[00000030h] 19_2_048B0050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04961074 mov eax, dword ptr fs:[00000030h] 19_2_04961074
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04952073 mov eax, dword ptr fs:[00000030h] 19_2_04952073
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BC182 mov eax, dword ptr fs:[00000030h] 19_2_048BC182
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CA185 mov eax, dword ptr fs:[00000030h] 19_2_048CA185
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C2990 mov eax, dword ptr fs:[00000030h] 19_2_048C2990
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C61A0 mov eax, dword ptr fs:[00000030h] 19_2_048C61A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C61A0 mov eax, dword ptr fs:[00000030h] 19_2_048C61A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049151BE mov eax, dword ptr fs:[00000030h] 19_2_049151BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049151BE mov eax, dword ptr fs:[00000030h] 19_2_049151BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049151BE mov eax, dword ptr fs:[00000030h] 19_2_049151BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049151BE mov eax, dword ptr fs:[00000030h] 19_2_049151BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049169A6 mov eax, dword ptr fs:[00000030h] 19_2_049169A6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489B1E1 mov eax, dword ptr fs:[00000030h] 19_2_0489B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489B1E1 mov eax, dword ptr fs:[00000030h] 19_2_0489B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489B1E1 mov eax, dword ptr fs:[00000030h] 19_2_0489B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049241E8 mov eax, dword ptr fs:[00000030h] 19_2_049241E8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04899100 mov eax, dword ptr fs:[00000030h] 19_2_04899100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04899100 mov eax, dword ptr fs:[00000030h] 19_2_04899100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04899100 mov eax, dword ptr fs:[00000030h] 19_2_04899100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B4120 mov eax, dword ptr fs:[00000030h] 19_2_048B4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B4120 mov eax, dword ptr fs:[00000030h] 19_2_048B4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B4120 mov eax, dword ptr fs:[00000030h] 19_2_048B4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B4120 mov eax, dword ptr fs:[00000030h] 19_2_048B4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B4120 mov ecx, dword ptr fs:[00000030h] 19_2_048B4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C513A mov eax, dword ptr fs:[00000030h] 19_2_048C513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C513A mov eax, dword ptr fs:[00000030h] 19_2_048C513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BB944 mov eax, dword ptr fs:[00000030h] 19_2_048BB944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BB944 mov eax, dword ptr fs:[00000030h] 19_2_048BB944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489C962 mov eax, dword ptr fs:[00000030h] 19_2_0489C962
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489B171 mov eax, dword ptr fs:[00000030h] 19_2_0489B171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489B171 mov eax, dword ptr fs:[00000030h] 19_2_0489B171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CD294 mov eax, dword ptr fs:[00000030h] 19_2_048CD294
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CD294 mov eax, dword ptr fs:[00000030h] 19_2_048CD294
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048952A5 mov eax, dword ptr fs:[00000030h] 19_2_048952A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048952A5 mov eax, dword ptr fs:[00000030h] 19_2_048952A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048952A5 mov eax, dword ptr fs:[00000030h] 19_2_048952A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048952A5 mov eax, dword ptr fs:[00000030h] 19_2_048952A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048952A5 mov eax, dword ptr fs:[00000030h] 19_2_048952A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AAAB0 mov eax, dword ptr fs:[00000030h] 19_2_048AAAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048AAAB0 mov eax, dword ptr fs:[00000030h] 19_2_048AAAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CFAB0 mov eax, dword ptr fs:[00000030h] 19_2_048CFAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C2ACB mov eax, dword ptr fs:[00000030h] 19_2_048C2ACB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C2AE4 mov eax, dword ptr fs:[00000030h] 19_2_048C2AE4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A8A0A mov eax, dword ptr fs:[00000030h] 19_2_048A8A0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495AA16 mov eax, dword ptr fs:[00000030h] 19_2_0495AA16
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495AA16 mov eax, dword ptr fs:[00000030h] 19_2_0495AA16
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048B3A1C mov eax, dword ptr fs:[00000030h] 19_2_048B3A1C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04895210 mov eax, dword ptr fs:[00000030h] 19_2_04895210
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04895210 mov ecx, dword ptr fs:[00000030h] 19_2_04895210
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04895210 mov eax, dword ptr fs:[00000030h] 19_2_04895210
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04895210 mov eax, dword ptr fs:[00000030h] 19_2_04895210
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489AA16 mov eax, dword ptr fs:[00000030h] 19_2_0489AA16
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489AA16 mov eax, dword ptr fs:[00000030h] 19_2_0489AA16
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D4A2C mov eax, dword ptr fs:[00000030h] 19_2_048D4A2C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D4A2C mov eax, dword ptr fs:[00000030h] 19_2_048D4A2C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495EA55 mov eax, dword ptr fs:[00000030h] 19_2_0495EA55
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04924257 mov eax, dword ptr fs:[00000030h] 19_2_04924257
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04899240 mov eax, dword ptr fs:[00000030h] 19_2_04899240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04899240 mov eax, dword ptr fs:[00000030h] 19_2_04899240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04899240 mov eax, dword ptr fs:[00000030h] 19_2_04899240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04899240 mov eax, dword ptr fs:[00000030h] 19_2_04899240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0494B260 mov eax, dword ptr fs:[00000030h] 19_2_0494B260
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0494B260 mov eax, dword ptr fs:[00000030h] 19_2_0494B260
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04968A62 mov eax, dword ptr fs:[00000030h] 19_2_04968A62
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048D927A mov eax, dword ptr fs:[00000030h] 19_2_048D927A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A1B8F mov eax, dword ptr fs:[00000030h] 19_2_048A1B8F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048A1B8F mov eax, dword ptr fs:[00000030h] 19_2_048A1B8F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0494D380 mov ecx, dword ptr fs:[00000030h] 19_2_0494D380
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C2397 mov eax, dword ptr fs:[00000030h] 19_2_048C2397
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048CB390 mov eax, dword ptr fs:[00000030h] 19_2_048CB390
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495138A mov eax, dword ptr fs:[00000030h] 19_2_0495138A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C4BAD mov eax, dword ptr fs:[00000030h] 19_2_048C4BAD
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C4BAD mov eax, dword ptr fs:[00000030h] 19_2_048C4BAD
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C4BAD mov eax, dword ptr fs:[00000030h] 19_2_048C4BAD
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04965BA5 mov eax, dword ptr fs:[00000030h] 19_2_04965BA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049153CA mov eax, dword ptr fs:[00000030h] 19_2_049153CA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_049153CA mov eax, dword ptr fs:[00000030h] 19_2_049153CA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048BDBE9 mov eax, dword ptr fs:[00000030h] 19_2_048BDBE9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C03E2 mov eax, dword ptr fs:[00000030h] 19_2_048C03E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C03E2 mov eax, dword ptr fs:[00000030h] 19_2_048C03E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C03E2 mov eax, dword ptr fs:[00000030h] 19_2_048C03E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C03E2 mov eax, dword ptr fs:[00000030h] 19_2_048C03E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C03E2 mov eax, dword ptr fs:[00000030h] 19_2_048C03E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C03E2 mov eax, dword ptr fs:[00000030h] 19_2_048C03E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0495131B mov eax, dword ptr fs:[00000030h] 19_2_0495131B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489DB40 mov eax, dword ptr fs:[00000030h] 19_2_0489DB40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_04968B58 mov eax, dword ptr fs:[00000030h] 19_2_04968B58
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489F358 mov eax, dword ptr fs:[00000030h] 19_2_0489F358
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_0489DB60 mov ecx, dword ptr fs:[00000030h] 19_2_0489DB60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C3B7A mov eax, dword ptr fs:[00000030h] 19_2_048C3B7A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 19_2_048C3B7A mov eax, dword ptr fs:[00000030h] 19_2_048C3B7A
Enables debug privileges
Source: C:\Users\user\Desktop\New_1007572_021.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.comfsresidential.com
Source: C:\Windows\explorer.exe Network Connect: 185.53.178.50 80 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\New_1007572_021.exe Memory written: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Thread register set: target process: 3424 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe Section unmapped: C:\Windows\SysWOW64\cscript.exe base address: E0000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\New_1007572_021.exe Memory written: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Memory written: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Memory written: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Memory written: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe base: 403000 Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Memory written: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe base: 404000 Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Memory written: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe base: CAD008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\New_1007572_021.exe Process created: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Process created: C:\Users\user\AppData\Local\Temp\FB_5908.tmp.exe 'C:\Users\user\AppData\Local\Temp\FB_5908.tmp.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\New_1007572_021.exe Process created: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe 'C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe' Jump to behavior
Source: explorer.exe, 0000000B.00000000.745550579.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 0000000B.00000000.784022003.0000000001080000.00000002.00000001.sdmp, cscript.exe, 00000013.00000002.925610456.0000000003460000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 0000000B.00000000.784022003.0000000001080000.00000002.00000001.sdmp, cscript.exe, 00000013.00000002.925610456.0000000003460000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000B.00000000.784022003.0000000001080000.00000002.00000001.sdmp, cscript.exe, 00000013.00000002.925610456.0000000003460000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000B.00000000.784022003.0000000001080000.00000002.00000001.sdmp, cscript.exe, 00000013.00000002.925610456.0000000003460000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 0000000B.00000000.771670358.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Users\user\Desktop\New_1007572_021.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New_1007572_021.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 0.2.New_1007572_021.exe.3eb8b30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.New_1007572_021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3bc9930.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3d7bea0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3d06480.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.926228324.0000000004F0F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925005416.0000000000278000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821727953.0000000001081000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821846658.00000000012B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.740535210.0000000000404000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925127682.0000000000490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.926114786.0000000004BA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821488799.0000000000E10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925530735.00000000031B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739038576.0000000003BCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.740219963.0000000001081000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739831969.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739343756.0000000003D06000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe, type: DROPPED

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 0.2.New_1007572_021.exe.3eb8b30.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.FB_5E87.tmp.exe.1080000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.New_1007572_021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3bc9930.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3d7bea0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New_1007572_021.exe.3d06480.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.926228324.0000000004F0F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925005416.0000000000278000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821727953.0000000001081000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821846658.00000000012B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.740535210.0000000000404000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925127682.0000000000490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.926114786.0000000004BA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.821488799.0000000000E10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.925530735.00000000031B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739038576.0000000003BCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.740219963.0000000001081000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739831969.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.739343756.0000000003D06000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\FB_5E87.tmp.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 458848 Sample: New_1007572_021.exe Startdate: 03/08/2021 Architecture: WINDOWS Score: 100 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 5 other signatures 2->60 11 New_1007572_021.exe 5 2->11         started        process3 file4 40 C:\Users\user\AppData\...40ew_1007572_021.exe, PE32 11->40 dropped 42 C:\...42ew_1007572_021.exe:Zone.Identifier, ASCII 11->42 dropped 44 C:\Users\user\...44ew_1007572_021.exe.log, ASCII 11->44 dropped 72 Writes to foreign memory regions 11->72 74 Injects a PE file into a foreign processes 11->74 15 New_1007572_021.exe 1 5 11->15         started        signatures5 process6 dnsIp7 48 192.168.2.1 unknown unknown 15->48 36 C:\Users\user\AppData\...\FB_5E87.tmp.exe, PE32 15->36 dropped 38 C:\Users\user\AppData\...\FB_5908.tmp.exe, PE32 15->38 dropped 50 Multi AV Scanner detection for dropped file 15->50 52 Machine Learning detection for dropped file 15->52 20 FB_5E87.tmp.exe 15->20         started        23 FB_5908.tmp.exe 15->23         started        file8 signatures9 process10 signatures11 62 Antivirus detection for dropped file 20->62 64 Multi AV Scanner detection for dropped file 20->64 66 Machine Learning detection for dropped file 20->66 68 5 other signatures 20->68 25 explorer.exe 20->25 injected process12 dnsIp13 46 www.comfsresidential.com 185.53.178.50, 49760, 80 TEAMINTERNET-ASDE Germany 25->46 70 System process connects to network (likely due to code injection or exploit) 25->70 29 cscript.exe 25->29         started        signatures14 process15 signatures16 76 Modifies the context of a thread in another process (thread injection) 29->76 78 Maps a DLL or memory area into another process 29->78 80 Tries to detect virtualization through RDTSC time measurements 29->80 32 cmd.exe 1 29->32         started        process17 process18 34 conhost.exe 32->34         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.53.178.50
 www.comfsresidential.com Germany
61969 TEAMINTERNET-ASDE true

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
www.comfsresidential.com 185.53.178.50 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.comfsresidential.com/cg53/?y48=RnXd-dV8&04VdoL_=jL4gYOGdbdGLgCuh81HWgUyhq6g08d9KQ1n+auYX12/KRBTZXwpphFOeP1KBAJVgFN6h true
  • Avira URL Cloud: safe
 unknown