Windows Analysis Report Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Overview

General Information

Sample Name: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Analysis ID: 483527
MD5: e29285288905ebb27d9e4443bcaa6638
SHA1: 3c656f9257b7630e47f57d1326bceafb7481ab29
SHA256: 7027a232f8327a532a1b37586cd42ea73ea0b9c37b1b22334484888f0b13b6b6
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Self deletion via cmd delete
.NET source code contains potential unpacker
Queues an APC in another process (thread injection)
.NET source code contains very large strings
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Creates processes with suspicious names
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.fasilitatortoefl.com/uytf/"], "decoy": ["estherestates.online", "babyballetwigan.com", "ignorantrough.xyz", "moominmamalog.com", "pasticcerialemmi.com", "orangstyle.com", "oldwaterfordfarm.com", "aiiqiuwnsas.com", "youindependents.com", "runbank.net", "phytolipshine.com", "almedmedicalcenter.com", "czxzsa.com", "yummyblockparty.com", "gadgetinfo.info", "cloudfolderplayer.com", "chowding.com", "xn--tarzmbu-ufb.com", "danielaasab.com", "dreampropertiesluxury.com", "itsready.support", "freepoeople.com", "richesosity.online", "covidbrainfogsyndrome.com", "hide.osaka", "fitotec.net", "cdfdwj.com", "vjr.realestate", "knowit.today", "sellhomefastinorlando.com", "permacademy.net", "andhraadvocates.com", "rochainrevsry.xyz", "casino-virtuali.net", "liptondesignstudio.xyz", "keyinternationals.com", "gamifibase.com", "atjehtimur.com", "hobonickelsvillarrubia.com", "johnharrisagent.com", "preabsorb.xyz", "likevietsub38.com", "getrichandsavetheworld.com", "livelife2dance.com", "juesparza.com", "buffalocreekdesign.com", "diegos.xyz", "covidforensicaudit.com", "popitperu.com", "gczvahqeg.site", "aspireship.tech", "freedomforfarmedrabbits.online", "pasalsacongress.com", "custommetalimagery.photography", "managementcoachinginc.com", "hxysjkj.com", "trusticoin.biz", "wireconnectaz.tech", "yoiseikatsu.net", "slggroups.com", "curiousmug.com", "svetarielt.site", "nongormart.com", "btt5204.com"]}
Multi AV Scanner detection for submitted file
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Virustotal: Detection: 28% Perma Link
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe ReversingLabs: Detection: 57%
Yara detected FormBook
Source: Yara match File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Machine Learning detection for sample
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.302407881.0000000001390000.00000040.00000001.sdmp, raserver.exe, 00000013.00000002.477861762.000000000484F000.00000040.00000001.sdmp
Source: Binary string: RAServer.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.301852623.0000000000F59000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.302407881.0000000001390000.00000040.00000001.sdmp, raserver.exe
Source: Binary string: RAServer.pdbGCTL source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.301852623.0000000000F59000.00000004.00000020.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\HJmNUXoTNN\src\obj\Debug\SerializationHeaderReco.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 4x nop then pop ebx 5_2_00406AAD
Source: C:\Windows\SysWOW64\raserver.exe Code function: 4x nop then pop ebx 19_2_00706AAD

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49784 -> 198.54.117.211:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49784 -> 198.54.117.211:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49784 -> 198.54.117.211:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.yummyblockparty.com
Source: C:\Windows\explorer.exe Domain query: www.fitotec.net
Source: C:\Windows\explorer.exe Domain query: www.johnharrisagent.com
Source: C:\Windows\explorer.exe Domain query: www.btt5204.com
Source: C:\Windows\explorer.exe Network Connect: 52.71.133.130 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.hide.osaka
Source: C:\Windows\explorer.exe Network Connect: 198.54.117.211 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 103.15.104.66 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 198.54.117.215 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.itsready.support
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.fasilitatortoefl.com/uytf/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View ASN Name: GIGABIT-MYGigabitHostingSdnBhdMY GIGABIT-MYGigabitHostingSdnBhdMY
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /uytf/?4hax=Z6tv0ZGri8uWurB8AUDeWgq8Hn78EURDlDEEMIHUNMQGUG9NVGnXX5+ZYyjQXpOA0JMU&6lE=xT6Pc HTTP/1.1Host: www.yummyblockparty.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7DtpN0+eCTBT&6lE=xT6Pc HTTP/1.1Host: www.johnharrisagent.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /uytf/?4hax=Lw8pQUl/qe2gQHW8JEklnfX9vlL4ErZAhlphDfsrttl8uYXfrtRE5waSCzthMEOsFHNR&6lE=xT6Pc HTTP/1.1Host: www.itsready.supportConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /uytf/?4hax=0R01lDMz+xXIWoinSyO5qQyNMJHeVacFioz47MHPNe7DMd9wx+TtySfTu0uIVXra7tyR&6lE=xT6Pc HTTP/1.1Host: www.btt5204.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 52.71.133.130 52.71.133.130
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226460143.0000000002841000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213161728.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213161728.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com%$I/d
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com9
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comYou
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213196484.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comm
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.como
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.como..
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comueh
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comva
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213244678.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comy
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213196484.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comypo
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comz
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216127582.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com-O6d
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com.TTFsO
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216064181.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216985898.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216099763.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comS
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comals
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216461639.0000000005F35000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comasF
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.219234603.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comceva
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216127582.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comcomS
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comd
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216654283.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comdAO
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216627255.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comgritaHO
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.219234603.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comgritolOyd
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216654283.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.como
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216064181.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comrsiv
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216654283.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comttF
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comttod
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213011209.0000000005F2D000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212822532.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213011209.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cncz
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213011209.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnly
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217666193.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217951742.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217690168.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.krKKd
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213811208.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/-O6d
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/0O
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/;O$dh
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/HO
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213811208.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/It
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/VO
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214195042.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0nl
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/eOndo
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213925578.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/0O
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/lOyd
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213925578.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/lOyd
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214195042.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213811208.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ty
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213284821.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.micro(D.df
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr2K
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr8
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212459989.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.krQK
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213130693.0000000005F2D000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213161728.0000000005F2F000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cnrsCI
Source: raserver.exe, 00000013.00000002.479062532.0000000004DE2000.00000004.00020000.sdmp String found in binary or memory: https://www.johnharrisagent.com/uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7
Source: unknown DNS traffic detected: queries for: www.yummyblockparty.com
Source: global traffic HTTP traffic detected: GET /uytf/?4hax=Z6tv0ZGri8uWurB8AUDeWgq8Hn78EURDlDEEMIHUNMQGUG9NVGnXX5+ZYyjQXpOA0JMU&6lE=xT6Pc HTTP/1.1Host: www.yummyblockparty.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7DtpN0+eCTBT&6lE=xT6Pc HTTP/1.1Host: www.johnharrisagent.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /uytf/?4hax=Lw8pQUl/qe2gQHW8JEklnfX9vlL4ErZAhlphDfsrttl8uYXfrtRE5waSCzthMEOsFHNR&6lE=xT6Pc HTTP/1.1Host: www.itsready.supportConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /uytf/?4hax=0R01lDMz+xXIWoinSyO5qQyNMJHeVacFioz47MHPNe7DMd9wx+TtySfTu0uIVXra7tyR&6lE=xT6Pc HTTP/1.1Host: www.btt5204.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.225993143.0000000000BBB000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: initial sample Static PE information: Filename: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
.NET source code contains very large strings
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, ConsoleGame/Form1.cs Long String: Length: 50988
Source: 1.0.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.3c0000.0.unpack, ConsoleGame/Form1.cs Long String: Length: 50988
Source: 1.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.3c0000.0.unpack, ConsoleGame/Form1.cs Long String: Length: 50988
Source: 5.0.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.8a0000.0.unpack, ConsoleGame/Form1.cs Long String: Length: 50988
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.8a0000.1.unpack, ConsoleGame/Form1.cs Long String: Length: 50988
Uses 32bit PE files
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 1_2_04890040 1_2_04890040
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 1_2_0489003F 1_2_0489003F
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041D179 5_2_0041D179
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041C1D0 5_2_0041C1D0
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041C9FF 5_2_0041C9FF
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041CA0B 5_2_0041CA0B
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00408C7B 5_2_00408C7B
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041C4CC 5_2_0041C4CC
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00408C80 5_2_00408C80
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041BDE3 5_2_0041BDE3
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00402D87 5_2_00402D87
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041C5B7 5_2_0041C5B7
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476841F 19_2_0476841F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481D466 19_2_0481D466
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04750D20 19_2_04750D20
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048225DD 19_2_048225DD
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04822D07 19_2_04822D07
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476D5E0 19_2_0476D5E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04821D55 19_2_04821D55
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04782581 19_2_04782581
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04776E30 19_2_04776E30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04822EF7 19_2_04822EF7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481D616 19_2_0481D616
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0482DFCE 19_2_0482DFCE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04821FF1 19_2_04821FF1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048220A8 19_2_048220A8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A830 19_2_0477A830
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048228EC 19_2_048228EC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811002 19_2_04811002
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0482E824 19_2_0482E824
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047820A0 19_2_047820A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476B090 19_2_0476B090
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04774120 19_2_04774120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475F900 19_2_0475F900
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048222AE 19_2_048222AE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0480FA2B 19_2_0480FA2B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477AB40 19_2_0477AB40
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481DBD2 19_2_0481DBD2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048103DA 19_2_048103DA
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04822B28 19_2_04822B28
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478EBB0 19_2_0478EBB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071D179 19_2_0071D179
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071C9FF 19_2_0071C9FF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071C1D0 19_2_0071C1D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071CA0B 19_2_0071CA0B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_00708C7B 19_2_00708C7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071C4CC 19_2_0071C4CC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_00708C80 19_2_00708C80
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071BDE3 19_2_0071BDE3
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_00702D90 19_2_00702D90
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_00702D87 19_2_00702D87
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_00702FB0 19_2_00702FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\raserver.exe Code function: String function: 0475B150 appears 72 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_004185E0 NtCreateFile, 5_2_004185E0
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00418690 NtReadFile, 5_2_00418690
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00418710 NtClose, 5_2_00418710
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_004187C0 NtAllocateVirtualMemory, 5_2_004187C0
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041868A NtReadFile, 5_2_0041868A
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041870A NtClose, 5_2_0041870A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799540 NtReadFile,LdrInitializeThunk, 19_2_04799540
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047995D0 NtClose,LdrInitializeThunk, 19_2_047995D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799660 NtAllocateVirtualMemory,LdrInitializeThunk, 19_2_04799660
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799650 NtQueryValueKey,LdrInitializeThunk, 19_2_04799650
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047996E0 NtFreeVirtualMemory,LdrInitializeThunk, 19_2_047996E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047996D0 NtCreateKey,LdrInitializeThunk, 19_2_047996D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799710 NtQueryInformationToken,LdrInitializeThunk, 19_2_04799710
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799FE0 NtCreateMutant,LdrInitializeThunk, 19_2_04799FE0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799780 NtMapViewOfSection,LdrInitializeThunk, 19_2_04799780
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799860 NtQuerySystemInformation,LdrInitializeThunk, 19_2_04799860
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799840 NtDelayExecution,LdrInitializeThunk, 19_2_04799840
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799910 NtAdjustPrivilegesToken,LdrInitializeThunk, 19_2_04799910
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047999A0 NtCreateSection,LdrInitializeThunk, 19_2_047999A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799A50 NtCreateFile,LdrInitializeThunk, 19_2_04799A50
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799560 NtWriteFile, 19_2_04799560
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0479AD30 NtSetContextThread, 19_2_0479AD30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799520 NtWaitForSingleObject, 19_2_04799520
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047995F0 NtQueryInformationFile, 19_2_047995F0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799670 NtQueryInformationProcess, 19_2_04799670
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799610 NtEnumerateValueKey, 19_2_04799610
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0479A770 NtOpenThread, 19_2_0479A770
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799770 NtSetInformationFile, 19_2_04799770
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799760 NtOpenProcess, 19_2_04799760
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799730 NtQueryVirtualMemory, 19_2_04799730
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0479A710 NtOpenProcessToken, 19_2_0479A710
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047997A0 NtUnmapViewOfSection, 19_2_047997A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0479B040 NtSuspendThread, 19_2_0479B040
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799820 NtEnumerateKey, 19_2_04799820
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047998F0 NtReadVirtualMemory, 19_2_047998F0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047998A0 NtWriteVirtualMemory, 19_2_047998A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799950 NtQueueApcThread, 19_2_04799950
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047999D0 NtCreateProcessEx, 19_2_047999D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799A20 NtResumeThread, 19_2_04799A20
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799A10 NtQuerySection, 19_2_04799A10
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799A00 NtProtectVirtualMemory, 19_2_04799A00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799A80 NtOpenDirectoryObject, 19_2_04799A80
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04799B00 NtSetValueKey, 19_2_04799B00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0479A3B0 NtGetContextThread, 19_2_0479A3B0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_007185E0 NtCreateFile, 19_2_007185E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_00718690 NtReadFile, 19_2_00718690
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_00718710 NtClose, 19_2_00718710
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_007187C0 NtAllocateVirtualMemory, 19_2_007187C0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071868A NtReadFile, 19_2_0071868A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071870A NtClose, 19_2_0071870A
Sample file is different than original file name gathered from version info
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Binary or memory string: OriginalFilename vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.225335486.00000000003C2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSerializationHeaderReco.exe8 vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.225993143.0000000000BBB000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameEnvoySinks.dll6 vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Binary or memory string: OriginalFilename vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.302006215.0000000000F94000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameraserver.exej% vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.303502359.000000000163F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.301350548.00000000008A2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSerializationHeaderReco.exe8 vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Binary or memory string: OriginalFilenameSerializationHeaderReco.exe8 vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Virustotal: Detection: 28%
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe ReversingLabs: Detection: 57%
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe File read: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe:Zone.Identifier Jump to behavior
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process created: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process created: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe' Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/1@11/4
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1392:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wntdll.pdbUGP source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.302407881.0000000001390000.00000040.00000001.sdmp, raserver.exe, 00000013.00000002.477861762.000000000484F000.00000040.00000001.sdmp
Source: Binary string: RAServer.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.301852623.0000000000F59000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.302407881.0000000001390000.00000040.00000001.sdmp, raserver.exe
Source: Binary string: RAServer.pdbGCTL source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.301852623.0000000000F59000.00000004.00000020.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\HJmNUXoTNN\src\obj\Debug\SerializationHeaderReco.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, ConsoleGame/Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 1.0.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.3c0000.0.unpack, ConsoleGame/Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 1.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.3c0000.0.unpack, ConsoleGame/Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.8a0000.0.unpack, ConsoleGame/Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.8a0000.1.unpack, ConsoleGame/Form1.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041B822 push eax; ret 5_2_0041B828
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041B82B push eax; ret 5_2_0041B892
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041B88C push eax; ret 5_2_0041B892
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00418AC2 push ecx; ret 5_2_00418AC3
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00415B75 push ds; ret 5_2_00415B85
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_0041B7D5 push eax; ret 5_2_0041B828
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047AD0D1 push ecx; ret 19_2_047AD0E4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071B822 push eax; ret 19_2_0071B828
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071B82B push eax; ret 19_2_0071B892
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071B88C push eax; ret 19_2_0071B892
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_00718AC2 push ecx; ret 19_2_00718AC3
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_00715B75 push ds; ret 19_2_00715B85
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0071B7D5 push eax; ret 19_2_0071B828
Source: initial sample Static PE information: section name: .text entropy: 7.48050578829

Persistence and Installation Behavior:

barindex
Creates processes with suspicious names
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe File created: \electronic payment remittance document 09.13.21 vrf 65665011119889.exe
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe File created: \electronic payment remittance document 09.13.21 vrf 65665011119889.exe Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\raserver.exe Process created: /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'
Source: C:\Windows\SysWOW64\raserver.exe Process created: /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe' Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe PID: 3176, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe RDTSC instruction interceptor: First address: 0000000000408604 second address: 000000000040860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe RDTSC instruction interceptor: First address: 000000000040899E second address: 00000000004089A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 0000000000708604 second address: 000000000070860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 000000000070899E second address: 00000000007089A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -239859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -239749s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -239640s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -239531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -239422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -239311s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -239202s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -239063s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -238953s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -238781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -238656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -238531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -238422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -238309s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -238156s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -238046s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -237921s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -237812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -237687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -237578s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -237469s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -237344s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -237203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -237047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -236921s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -236797s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -236672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -236547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -236422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -236297s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -236172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -236063s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -235906s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -235797s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -235672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -235563s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -235407s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -235296s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -235172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -235047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -234906s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -234765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -234655s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -234547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -234437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -234328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -234219s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -234047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -233922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -233796s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 1364 Thread sleep time: -43239s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -233672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -233546s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -233437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -233297s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -233187s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -233078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -232953s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -232844s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -232703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -232594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -232484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340 Thread sleep time: -232375s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 908 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 1124 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 6088 Thread sleep time: -36000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\raserver.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_004088D0 rdtsc 5_2_004088D0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239859 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239749 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239640 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239531 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239422 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239311 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239202 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239063 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238953 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238781 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238656 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238531 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238422 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238309 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238156 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238046 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237921 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237812 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237687 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237578 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237469 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237344 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237203 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237047 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236921 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236797 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236672 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236547 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236422 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236297 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236172 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236063 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235906 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235797 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235672 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235563 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235407 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235296 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235172 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235047 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234906 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234765 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234655 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234547 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234437 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234328 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234219 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234047 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233922 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233796 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233672 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233546 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233437 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233297 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233187 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233078 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232953 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232844 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232703 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232594 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232484 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232375 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Window / User API: threadDelayed 6984 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Window / User API: threadDelayed 974 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\raserver.exe API coverage: 8.5 %
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239859 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239749 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239640 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239531 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239422 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239311 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239202 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 239063 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238953 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238781 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238656 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238531 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238422 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238309 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238156 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 238046 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237921 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237812 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237687 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237578 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237469 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237344 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237203 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 237047 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236921 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236797 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236672 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236547 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236422 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236297 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236172 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 236063 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235906 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235797 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235672 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235563 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235407 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235296 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235172 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 235047 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234906 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234765 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234655 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234547 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234437 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234328 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234219 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 234047 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233922 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233796 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 43239 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233672 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233546 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233437 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233297 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233187 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 233078 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232953 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232844 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232703 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232594 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232484 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 232375 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000006.00000000.268488988.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000006.00000000.268488988.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000006.00000000.235824977.0000000008640000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: vmware
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000006.00000000.230183542.0000000004E61000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATAv
Source: explorer.exe, 00000006.00000000.268488988.000000000871F000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oft.Mic
Source: explorer.exe, 00000006.00000000.291724518.00000000055D0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000006.00000000.236758134.0000000008907000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}##
Source: explorer.exe, 00000006.00000000.230090929.0000000004DE0000.00000004.00000001.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}1SPS0
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: explorer.exe, 00000006.00000000.268488988.000000000871F000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000006.00000000.268488988.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000006.00000000.253375018.00000000087D1000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000006.00000000.248820491.0000000005603000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_004088D0 rdtsc 5_2_004088D0
Enables debug privileges
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477746D mov eax, dword ptr fs:[00000030h] 19_2_0477746D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EC450 mov eax, dword ptr fs:[00000030h] 19_2_047EC450
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EC450 mov eax, dword ptr fs:[00000030h] 19_2_047EC450
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478A44B mov eax, dword ptr fs:[00000030h] 19_2_0478A44B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04828CD6 mov eax, dword ptr fs:[00000030h] 19_2_04828CD6
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478BC2C mov eax, dword ptr fs:[00000030h] 19_2_0478BC2C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6C0A mov eax, dword ptr fs:[00000030h] 19_2_047D6C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6C0A mov eax, dword ptr fs:[00000030h] 19_2_047D6C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6C0A mov eax, dword ptr fs:[00000030h] 19_2_047D6C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6C0A mov eax, dword ptr fs:[00000030h] 19_2_047D6C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048114FB mov eax, dword ptr fs:[00000030h] 19_2_048114FB
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h] 19_2_04811C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6CF0 mov eax, dword ptr fs:[00000030h] 19_2_047D6CF0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6CF0 mov eax, dword ptr fs:[00000030h] 19_2_047D6CF0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6CF0 mov eax, dword ptr fs:[00000030h] 19_2_047D6CF0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0482740D mov eax, dword ptr fs:[00000030h] 19_2_0482740D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0482740D mov eax, dword ptr fs:[00000030h] 19_2_0482740D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0482740D mov eax, dword ptr fs:[00000030h] 19_2_0482740D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476849B mov eax, dword ptr fs:[00000030h] 19_2_0476849B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477C577 mov eax, dword ptr fs:[00000030h] 19_2_0477C577
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477C577 mov eax, dword ptr fs:[00000030h] 19_2_0477C577
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04777D50 mov eax, dword ptr fs:[00000030h] 19_2_04777D50
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048205AC mov eax, dword ptr fs:[00000030h] 19_2_048205AC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048205AC mov eax, dword ptr fs:[00000030h] 19_2_048205AC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04793D43 mov eax, dword ptr fs:[00000030h] 19_2_04793D43
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D3540 mov eax, dword ptr fs:[00000030h] 19_2_047D3540
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h] 19_2_04763D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04784D3B mov eax, dword ptr fs:[00000030h] 19_2_04784D3B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04784D3B mov eax, dword ptr fs:[00000030h] 19_2_04784D3B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04784D3B mov eax, dword ptr fs:[00000030h] 19_2_04784D3B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475AD30 mov eax, dword ptr fs:[00000030h] 19_2_0475AD30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047DA537 mov eax, dword ptr fs:[00000030h] 19_2_047DA537
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481FDE2 mov eax, dword ptr fs:[00000030h] 19_2_0481FDE2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481FDE2 mov eax, dword ptr fs:[00000030h] 19_2_0481FDE2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481FDE2 mov eax, dword ptr fs:[00000030h] 19_2_0481FDE2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481FDE2 mov eax, dword ptr fs:[00000030h] 19_2_0481FDE2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04808DF1 mov eax, dword ptr fs:[00000030h] 19_2_04808DF1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476D5E0 mov eax, dword ptr fs:[00000030h] 19_2_0476D5E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476D5E0 mov eax, dword ptr fs:[00000030h] 19_2_0476D5E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6DC9 mov eax, dword ptr fs:[00000030h] 19_2_047D6DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6DC9 mov eax, dword ptr fs:[00000030h] 19_2_047D6DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6DC9 mov eax, dword ptr fs:[00000030h] 19_2_047D6DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6DC9 mov ecx, dword ptr fs:[00000030h] 19_2_047D6DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6DC9 mov eax, dword ptr fs:[00000030h] 19_2_047D6DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D6DC9 mov eax, dword ptr fs:[00000030h] 19_2_047D6DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04828D34 mov eax, dword ptr fs:[00000030h] 19_2_04828D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481E539 mov eax, dword ptr fs:[00000030h] 19_2_0481E539
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04803D40 mov eax, dword ptr fs:[00000030h] 19_2_04803D40
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04781DB5 mov eax, dword ptr fs:[00000030h] 19_2_04781DB5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04781DB5 mov eax, dword ptr fs:[00000030h] 19_2_04781DB5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04781DB5 mov eax, dword ptr fs:[00000030h] 19_2_04781DB5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047835A1 mov eax, dword ptr fs:[00000030h] 19_2_047835A1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478FD9B mov eax, dword ptr fs:[00000030h] 19_2_0478FD9B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478FD9B mov eax, dword ptr fs:[00000030h] 19_2_0478FD9B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04782581 mov eax, dword ptr fs:[00000030h] 19_2_04782581
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04782581 mov eax, dword ptr fs:[00000030h] 19_2_04782581
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04782581 mov eax, dword ptr fs:[00000030h] 19_2_04782581
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04782581 mov eax, dword ptr fs:[00000030h] 19_2_04782581
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04752D8A mov eax, dword ptr fs:[00000030h] 19_2_04752D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04752D8A mov eax, dword ptr fs:[00000030h] 19_2_04752D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04752D8A mov eax, dword ptr fs:[00000030h] 19_2_04752D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04752D8A mov eax, dword ptr fs:[00000030h] 19_2_04752D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04752D8A mov eax, dword ptr fs:[00000030h] 19_2_04752D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477AE73 mov eax, dword ptr fs:[00000030h] 19_2_0477AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477AE73 mov eax, dword ptr fs:[00000030h] 19_2_0477AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477AE73 mov eax, dword ptr fs:[00000030h] 19_2_0477AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477AE73 mov eax, dword ptr fs:[00000030h] 19_2_0477AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477AE73 mov eax, dword ptr fs:[00000030h] 19_2_0477AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476766D mov eax, dword ptr fs:[00000030h] 19_2_0476766D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04820EA5 mov eax, dword ptr fs:[00000030h] 19_2_04820EA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04820EA5 mov eax, dword ptr fs:[00000030h] 19_2_04820EA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04820EA5 mov eax, dword ptr fs:[00000030h] 19_2_04820EA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h] 19_2_04767E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h] 19_2_04767E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h] 19_2_04767E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h] 19_2_04767E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h] 19_2_04767E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h] 19_2_04767E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0480FEC0 mov eax, dword ptr fs:[00000030h] 19_2_0480FEC0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04828ED6 mov eax, dword ptr fs:[00000030h] 19_2_04828ED6
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475E620 mov eax, dword ptr fs:[00000030h] 19_2_0475E620
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478A61C mov eax, dword ptr fs:[00000030h] 19_2_0478A61C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478A61C mov eax, dword ptr fs:[00000030h] 19_2_0478A61C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475C600 mov eax, dword ptr fs:[00000030h] 19_2_0475C600
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475C600 mov eax, dword ptr fs:[00000030h] 19_2_0475C600
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475C600 mov eax, dword ptr fs:[00000030h] 19_2_0475C600
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04788E00 mov eax, dword ptr fs:[00000030h] 19_2_04788E00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04811608 mov eax, dword ptr fs:[00000030h] 19_2_04811608
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047676E2 mov eax, dword ptr fs:[00000030h] 19_2_047676E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047816E0 mov ecx, dword ptr fs:[00000030h] 19_2_047816E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047836CC mov eax, dword ptr fs:[00000030h] 19_2_047836CC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04798EC7 mov eax, dword ptr fs:[00000030h] 19_2_04798EC7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0480FE3F mov eax, dword ptr fs:[00000030h] 19_2_0480FE3F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481AE44 mov eax, dword ptr fs:[00000030h] 19_2_0481AE44
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481AE44 mov eax, dword ptr fs:[00000030h] 19_2_0481AE44
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D46A7 mov eax, dword ptr fs:[00000030h] 19_2_047D46A7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EFE87 mov eax, dword ptr fs:[00000030h] 19_2_047EFE87
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476FF60 mov eax, dword ptr fs:[00000030h] 19_2_0476FF60
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476EF40 mov eax, dword ptr fs:[00000030h] 19_2_0476EF40
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478E730 mov eax, dword ptr fs:[00000030h] 19_2_0478E730
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477B73D mov eax, dword ptr fs:[00000030h] 19_2_0477B73D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477B73D mov eax, dword ptr fs:[00000030h] 19_2_0477B73D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04754F2E mov eax, dword ptr fs:[00000030h] 19_2_04754F2E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04754F2E mov eax, dword ptr fs:[00000030h] 19_2_04754F2E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477F716 mov eax, dword ptr fs:[00000030h] 19_2_0477F716
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EFF10 mov eax, dword ptr fs:[00000030h] 19_2_047EFF10
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EFF10 mov eax, dword ptr fs:[00000030h] 19_2_047EFF10
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478A70E mov eax, dword ptr fs:[00000030h] 19_2_0478A70E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478A70E mov eax, dword ptr fs:[00000030h] 19_2_0478A70E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047937F5 mov eax, dword ptr fs:[00000030h] 19_2_047937F5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0482070D mov eax, dword ptr fs:[00000030h] 19_2_0482070D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0482070D mov eax, dword ptr fs:[00000030h] 19_2_0482070D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04768794 mov eax, dword ptr fs:[00000030h] 19_2_04768794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04828F6A mov eax, dword ptr fs:[00000030h] 19_2_04828F6A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D7794 mov eax, dword ptr fs:[00000030h] 19_2_047D7794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D7794 mov eax, dword ptr fs:[00000030h] 19_2_047D7794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D7794 mov eax, dword ptr fs:[00000030h] 19_2_047D7794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04770050 mov eax, dword ptr fs:[00000030h] 19_2_04770050
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04770050 mov eax, dword ptr fs:[00000030h] 19_2_04770050
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A830 mov eax, dword ptr fs:[00000030h] 19_2_0477A830
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A830 mov eax, dword ptr fs:[00000030h] 19_2_0477A830
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A830 mov eax, dword ptr fs:[00000030h] 19_2_0477A830
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A830 mov eax, dword ptr fs:[00000030h] 19_2_0477A830
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478002D mov eax, dword ptr fs:[00000030h] 19_2_0478002D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478002D mov eax, dword ptr fs:[00000030h] 19_2_0478002D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478002D mov eax, dword ptr fs:[00000030h] 19_2_0478002D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478002D mov eax, dword ptr fs:[00000030h] 19_2_0478002D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478002D mov eax, dword ptr fs:[00000030h] 19_2_0478002D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476B02A mov eax, dword ptr fs:[00000030h] 19_2_0476B02A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476B02A mov eax, dword ptr fs:[00000030h] 19_2_0476B02A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476B02A mov eax, dword ptr fs:[00000030h] 19_2_0476B02A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476B02A mov eax, dword ptr fs:[00000030h] 19_2_0476B02A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D7016 mov eax, dword ptr fs:[00000030h] 19_2_047D7016
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D7016 mov eax, dword ptr fs:[00000030h] 19_2_047D7016
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D7016 mov eax, dword ptr fs:[00000030h] 19_2_047D7016
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477B8E4 mov eax, dword ptr fs:[00000030h] 19_2_0477B8E4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477B8E4 mov eax, dword ptr fs:[00000030h] 19_2_0477B8E4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047540E1 mov eax, dword ptr fs:[00000030h] 19_2_047540E1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047540E1 mov eax, dword ptr fs:[00000030h] 19_2_047540E1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047540E1 mov eax, dword ptr fs:[00000030h] 19_2_047540E1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04824015 mov eax, dword ptr fs:[00000030h] 19_2_04824015
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04824015 mov eax, dword ptr fs:[00000030h] 19_2_04824015
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047558EC mov eax, dword ptr fs:[00000030h] 19_2_047558EC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EB8D0 mov eax, dword ptr fs:[00000030h] 19_2_047EB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EB8D0 mov ecx, dword ptr fs:[00000030h] 19_2_047EB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EB8D0 mov eax, dword ptr fs:[00000030h] 19_2_047EB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EB8D0 mov eax, dword ptr fs:[00000030h] 19_2_047EB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EB8D0 mov eax, dword ptr fs:[00000030h] 19_2_047EB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047EB8D0 mov eax, dword ptr fs:[00000030h] 19_2_047EB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478F0BF mov ecx, dword ptr fs:[00000030h] 19_2_0478F0BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478F0BF mov eax, dword ptr fs:[00000030h] 19_2_0478F0BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478F0BF mov eax, dword ptr fs:[00000030h] 19_2_0478F0BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047990AF mov eax, dword ptr fs:[00000030h] 19_2_047990AF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h] 19_2_047820A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h] 19_2_047820A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h] 19_2_047820A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h] 19_2_047820A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h] 19_2_047820A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h] 19_2_047820A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04812073 mov eax, dword ptr fs:[00000030h] 19_2_04812073
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04759080 mov eax, dword ptr fs:[00000030h] 19_2_04759080
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04821074 mov eax, dword ptr fs:[00000030h] 19_2_04821074
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D3884 mov eax, dword ptr fs:[00000030h] 19_2_047D3884
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D3884 mov eax, dword ptr fs:[00000030h] 19_2_047D3884
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475B171 mov eax, dword ptr fs:[00000030h] 19_2_0475B171
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475B171 mov eax, dword ptr fs:[00000030h] 19_2_0475B171
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475C962 mov eax, dword ptr fs:[00000030h] 19_2_0475C962
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048149A4 mov eax, dword ptr fs:[00000030h] 19_2_048149A4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048149A4 mov eax, dword ptr fs:[00000030h] 19_2_048149A4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048149A4 mov eax, dword ptr fs:[00000030h] 19_2_048149A4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_048149A4 mov eax, dword ptr fs:[00000030h] 19_2_048149A4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477B944 mov eax, dword ptr fs:[00000030h] 19_2_0477B944
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477B944 mov eax, dword ptr fs:[00000030h] 19_2_0477B944
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478513A mov eax, dword ptr fs:[00000030h] 19_2_0478513A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478513A mov eax, dword ptr fs:[00000030h] 19_2_0478513A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04774120 mov eax, dword ptr fs:[00000030h] 19_2_04774120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04774120 mov eax, dword ptr fs:[00000030h] 19_2_04774120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04774120 mov eax, dword ptr fs:[00000030h] 19_2_04774120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04774120 mov eax, dword ptr fs:[00000030h] 19_2_04774120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04774120 mov ecx, dword ptr fs:[00000030h] 19_2_04774120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04759100 mov eax, dword ptr fs:[00000030h] 19_2_04759100
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04759100 mov eax, dword ptr fs:[00000030h] 19_2_04759100
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04759100 mov eax, dword ptr fs:[00000030h] 19_2_04759100
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475B1E1 mov eax, dword ptr fs:[00000030h] 19_2_0475B1E1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475B1E1 mov eax, dword ptr fs:[00000030h] 19_2_0475B1E1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475B1E1 mov eax, dword ptr fs:[00000030h] 19_2_0475B1E1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047E41E8 mov eax, dword ptr fs:[00000030h] 19_2_047E41E8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D51BE mov eax, dword ptr fs:[00000030h] 19_2_047D51BE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D51BE mov eax, dword ptr fs:[00000030h] 19_2_047D51BE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D51BE mov eax, dword ptr fs:[00000030h] 19_2_047D51BE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D51BE mov eax, dword ptr fs:[00000030h] 19_2_047D51BE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov eax, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov eax, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov eax, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047799BF mov eax, dword ptr fs:[00000030h] 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047861A0 mov eax, dword ptr fs:[00000030h] 19_2_047861A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047861A0 mov eax, dword ptr fs:[00000030h] 19_2_047861A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D69A6 mov eax, dword ptr fs:[00000030h] 19_2_047D69A6
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04782990 mov eax, dword ptr fs:[00000030h] 19_2_04782990
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477C182 mov eax, dword ptr fs:[00000030h] 19_2_0477C182
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478A185 mov eax, dword ptr fs:[00000030h] 19_2_0478A185
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0479927A mov eax, dword ptr fs:[00000030h] 19_2_0479927A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047E4257 mov eax, dword ptr fs:[00000030h] 19_2_047E4257
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04759240 mov eax, dword ptr fs:[00000030h] 19_2_04759240
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04759240 mov eax, dword ptr fs:[00000030h] 19_2_04759240
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04759240 mov eax, dword ptr fs:[00000030h] 19_2_04759240
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04759240 mov eax, dword ptr fs:[00000030h] 19_2_04759240
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04794A2C mov eax, dword ptr fs:[00000030h] 19_2_04794A2C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04794A2C mov eax, dword ptr fs:[00000030h] 19_2_04794A2C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h] 19_2_0477A229
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h] 19_2_0477A229
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h] 19_2_0477A229
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h] 19_2_0477A229
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h] 19_2_0477A229
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h] 19_2_0477A229
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h] 19_2_0477A229
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h] 19_2_0477A229
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h] 19_2_0477A229
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475AA16 mov eax, dword ptr fs:[00000030h] 19_2_0475AA16
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475AA16 mov eax, dword ptr fs:[00000030h] 19_2_0475AA16
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04755210 mov eax, dword ptr fs:[00000030h] 19_2_04755210
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04755210 mov ecx, dword ptr fs:[00000030h] 19_2_04755210
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04755210 mov eax, dword ptr fs:[00000030h] 19_2_04755210
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04755210 mov eax, dword ptr fs:[00000030h] 19_2_04755210
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04773A1C mov eax, dword ptr fs:[00000030h] 19_2_04773A1C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04768A0A mov eax, dword ptr fs:[00000030h] 19_2_04768A0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481AA16 mov eax, dword ptr fs:[00000030h] 19_2_0481AA16
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481AA16 mov eax, dword ptr fs:[00000030h] 19_2_0481AA16
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04782AE4 mov eax, dword ptr fs:[00000030h] 19_2_04782AE4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04782ACB mov eax, dword ptr fs:[00000030h] 19_2_04782ACB
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476AAB0 mov eax, dword ptr fs:[00000030h] 19_2_0476AAB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0476AAB0 mov eax, dword ptr fs:[00000030h] 19_2_0476AAB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478FAB0 mov eax, dword ptr fs:[00000030h] 19_2_0478FAB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047552A5 mov eax, dword ptr fs:[00000030h] 19_2_047552A5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047552A5 mov eax, dword ptr fs:[00000030h] 19_2_047552A5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047552A5 mov eax, dword ptr fs:[00000030h] 19_2_047552A5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047552A5 mov eax, dword ptr fs:[00000030h] 19_2_047552A5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047552A5 mov eax, dword ptr fs:[00000030h] 19_2_047552A5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481EA55 mov eax, dword ptr fs:[00000030h] 19_2_0481EA55
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0480B260 mov eax, dword ptr fs:[00000030h] 19_2_0480B260
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0480B260 mov eax, dword ptr fs:[00000030h] 19_2_0480B260
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04828A62 mov eax, dword ptr fs:[00000030h] 19_2_04828A62
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478D294 mov eax, dword ptr fs:[00000030h] 19_2_0478D294
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478D294 mov eax, dword ptr fs:[00000030h] 19_2_0478D294
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0480D380 mov ecx, dword ptr fs:[00000030h] 19_2_0480D380
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04783B7A mov eax, dword ptr fs:[00000030h] 19_2_04783B7A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04783B7A mov eax, dword ptr fs:[00000030h] 19_2_04783B7A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481138A mov eax, dword ptr fs:[00000030h] 19_2_0481138A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475DB60 mov ecx, dword ptr fs:[00000030h] 19_2_0475DB60
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04825BA5 mov eax, dword ptr fs:[00000030h] 19_2_04825BA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475F358 mov eax, dword ptr fs:[00000030h] 19_2_0475F358
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0475DB40 mov eax, dword ptr fs:[00000030h] 19_2_0475DB40
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0481131B mov eax, dword ptr fs:[00000030h] 19_2_0481131B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h] 19_2_047803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h] 19_2_047803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h] 19_2_047803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h] 19_2_047803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h] 19_2_047803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h] 19_2_047803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0477DBE9 mov eax, dword ptr fs:[00000030h] 19_2_0477DBE9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D53CA mov eax, dword ptr fs:[00000030h] 19_2_047D53CA
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_047D53CA mov eax, dword ptr fs:[00000030h] 19_2_047D53CA
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04784BAD mov eax, dword ptr fs:[00000030h] 19_2_04784BAD
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04784BAD mov eax, dword ptr fs:[00000030h] 19_2_04784BAD
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04784BAD mov eax, dword ptr fs:[00000030h] 19_2_04784BAD
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04828B58 mov eax, dword ptr fs:[00000030h] 19_2_04828B58
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_0478B390 mov eax, dword ptr fs:[00000030h] 19_2_0478B390
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04782397 mov eax, dword ptr fs:[00000030h] 19_2_04782397
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04761B8F mov eax, dword ptr fs:[00000030h] 19_2_04761B8F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 19_2_04761B8F mov eax, dword ptr fs:[00000030h] 19_2_04761B8F
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Code function: 5_2_00409B40 LdrLoadDll, 5_2_00409B40
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.yummyblockparty.com
Source: C:\Windows\explorer.exe Domain query: www.fitotec.net
Source: C:\Windows\explorer.exe Domain query: www.johnharrisagent.com
Source: C:\Windows\explorer.exe Domain query: www.btt5204.com
Source: C:\Windows\explorer.exe Network Connect: 52.71.133.130 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.hide.osaka
Source: C:\Windows\explorer.exe Network Connect: 198.54.117.211 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 103.15.104.66 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 198.54.117.215 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.itsready.support
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Section unmapped: C:\Windows\SysWOW64\raserver.exe base address: C30000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread register set: target process: 3388 Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Thread register set: target process: 3388 Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Thread register set: target process: 3388 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Process created: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe' Jump to behavior
Source: explorer.exe, 00000006.00000000.260179688.0000000001398000.00000004.00000020.sdmp Binary or memory string: ProgmanamF
Source: explorer.exe, 00000006.00000000.229448758.0000000001980000.00000002.00020000.sdmp, raserver.exe, 00000013.00000002.476913226.0000000002FE0000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.250393211.0000000006860000.00000004.00000001.sdmp, raserver.exe, 00000013.00000002.476913226.0000000002FE0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.229448758.0000000001980000.00000002.00020000.sdmp, raserver.exe, 00000013.00000002.476913226.0000000002FE0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.229448758.0000000001980000.00000002.00020000.sdmp, raserver.exe, 00000013.00000002.476913226.0000000002FE0000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 483527 Sample: Electronic Payment Remittan... Startdate: 15/09/2021 Architecture: WINDOWS Score: 100 38 www.pasalsacongress.com 2->38 40 pasalsacongress.com 2->40 42 www.moominmamalog.com 2->42 46 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->46 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 10 other signatures 2->52 11 Electronic Payment Remittance Document 09.13.21  VRF 65665011119889.exe 3 2->11         started        signatures3 process4 file5 30 Electronic Payment...65011119889.exe.log, ASCII 11->30 dropped 14 Electronic Payment Remittance Document 09.13.21  VRF 65665011119889.exe 11->14         started        process6 signatures7 62 Modifies the context of a thread in another process (thread injection) 14->62 64 Maps a DLL or memory area into another process 14->64 66 Sample uses process hollowing technique 14->66 68 Queues an APC in another process (thread injection) 14->68 17 explorer.exe 14->17 injected process8 dnsIp9 32 198.54.117.211, 49784, 80 NAMECHEAP-NETUS United States 17->32 34 v3lala99.cdnddd.net 103.15.104.66, 49785, 80 GIGABIT-MYGigabitHostingSdnBhdMY Malaysia 17->34 36 9 other IPs or domains 17->36 44 System process connects to network (likely due to code injection or exploit) 17->44 21 raserver.exe 17->21         started        24 autoconv.exe 17->24         started        signatures10 process11 signatures12 54 Self deletion via cmd delete 21->54 56 Modifies the context of a thread in another process (thread injection) 21->56 58 Maps a DLL or memory area into another process 21->58 60 Tries to detect virtualization through RDTSC time measurements 21->60 26 cmd.exe 1 21->26         started        process13 process14 28 conhost.exe 26->28         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
52.71.133.130
 www.johnharrisagent.com United States
14618 AMAZON-AESUS false
198.54.117.211
 unknown United States
22612 NAMECHEAP-NETUS true
103.15.104.66
 v3lala99.cdnddd.net Malaysia
55720 GIGABIT-MYGigabitHostingSdnBhdMY true
198.54.117.215
 parkingpage.namecheap.com United States
22612 NAMECHEAP-NETUS false

Contacted Domains

Name IP Active
pasalsacongress.com 192.185.52.175 true
parkingpage.namecheap.com 198.54.117.215 true
www.johnharrisagent.com 52.71.133.130 true
v3lala99.cdnddd.net 103.15.104.66 true
www.moominmamalog.com 183.181.96.104 true
www.yummyblockparty.com unknown unknown
www.hide.osaka unknown unknown
www.pasalsacongress.com unknown unknown
www.fitotec.net unknown unknown
www.btt5204.com unknown unknown
www.itsready.support unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.fasilitatortoefl.com/uytf/ true
  • Avira URL Cloud: safe
 low
http://www.btt5204.com/uytf/?4hax=0R01lDMz+xXIWoinSyO5qQyNMJHeVacFioz47MHPNe7DMd9wx+TtySfTu0uIVXra7tyR&6lE=xT6Pc true
  • Avira URL Cloud: safe
 unknown
http://www.itsready.support/uytf/?4hax=Lw8pQUl/qe2gQHW8JEklnfX9vlL4ErZAhlphDfsrttl8uYXfrtRE5waSCzthMEOsFHNR&6lE=xT6Pc true
  • Avira URL Cloud: safe
 unknown
http://www.johnharrisagent.com/uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7DtpN0+eCTBT&6lE=xT6Pc false
    		high