Windows Analysis Report z7d1ehQQQW.exe

Overview

General Information

Sample Name: z7d1ehQQQW.exe
Analysis ID: 491384
MD5: 50568fb6133ee4ed721ee46a3c0a9e98
SHA1: 4897b6f2141395071652f72d34dc3d39eb014a56
SHA256: 2b1a98add215568bb5e1c333321cf0ffe98d9128fa149c4f5a07ce2922750b3e
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Modifies the prolog of user mode functions (user mode inline hooks)
Self deletion via cmd delete
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.676864808.0000000003BE9000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.odysseysailingsantorini.com/cmsr/"], "decoy": ["dahlia-dolls.com", "iamawife.com", "gardunomx.com", "roweelitetrucking.com", "asapvk.com", "strategieslimited.com", "healthyweathorganics.com", "wedding-gallery.net", "fastoffer.online", "biolab33.cloud", "los40delocta.com", "charliepaton.com", "jenpaddock.com", "zzmweb.com", "poetarts.com", "techwork4u.com", "tracylynpropp.com", "rkbodyfit.site", "migaleriapanama.com", "cosmostco.com", "johnsoncamping.com", "flowfinancialplanning.com", "xn--caamosdemexico-rnb.com", "plusqueindia.com", "wwwhyprr.com", "benimofis.com", "tandteutopia.com", "spaintravelvacation.com", "dear.services", "zhiwugongfang.com", "blogdavnc.com", "justicefundingexchange.com", "alphasecreweb.info", "xitechgroup.com", "kendalmountain.digital", "nieght.com", "pieter-janenmaaike.online", "myexclusiveshop.com", "love-potato.online", "mondebestglobal.com", "ranchlandconcierge.com", "southerngraphx.com", "pray4usa.info", "vilchesfinancial.com", "zelvio.store", "zenibusiness.com", "kindredhue.com", "californiatacosdinuba.com", "uncommonsolutionsllc.com", "easy-lah.com", "disciplesevents.com", "856380127.xyz", "zapzapgone.com", "paradisgrp.com", "programmerworks.info", "purchasesuite.com", "dorotajedrusik.com", "555999dy.com", "uvoyus.com", "utang.net", "elizabethhelma.com", "noseainsight.com", "simpleterior.com", "casatensina.com"]}
Multi AV Scanner detection for submitted file
Source: z7d1ehQQQW.exe Virustotal: Detection: 24% Perma Link
Source: z7d1ehQQQW.exe ReversingLabs: Detection: 13%
Yara detected FormBook
Source: Yara match File source: 5.2.z7d1ehQQQW.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.z7d1ehQQQW.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.699728442.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917024748.0000000000930000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.676864808.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735760553.00000000017D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917376978.0000000002990000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735028940.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917716659.0000000002D50000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.715863161.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735825753.0000000001810000.00000040.00020000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.noseainsight.com/cmsr/?jtxXAR=f6Ad&4h0XO=aWr8NZzAm1//W065YDaH8MvMe5V7nlKazoNvd1fDio5dOX3Vx686XIFmrsqZJNrwHW47 Avira URL Cloud: Label: malware
Antivirus or Machine Learning detection for unpacked file
Source: 5.2.z7d1ehQQQW.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: z7d1ehQQQW.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: z7d1ehQQQW.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cscript.pdbUGP source: z7d1ehQQQW.exe, 00000005.00000002.736665067.0000000003520000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: z7d1ehQQQW.exe, 00000005.00000002.736099358.00000000019AF000.00000040.00000001.sdmp, cscript.exe, 00000009.00000002.918389183.00000000049AF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: z7d1ehQQQW.exe, 00000005.00000002.736099358.00000000019AF000.00000040.00000001.sdmp, cscript.exe
Source: Binary string: cscript.pdb source: z7d1ehQQQW.exe, 00000005.00000002.736665067.0000000003520000.00000040.00020000.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 4x nop then pop ebx 5_2_00407AFA
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 4x nop then pop edi 5_2_00417D59
Source: C:\Windows\SysWOW64\cscript.exe Code function: 4x nop then pop ebx 9_2_02D57AFB

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49822 -> 35.246.6.109:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49822 -> 35.246.6.109:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49822 -> 35.246.6.109:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49852 -> 47.91.170.222:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49852 -> 47.91.170.222:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49852 -> 47.91.170.222:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.dorotajedrusik.com
Source: C:\Windows\explorer.exe Domain query: www.noseainsight.com
Source: C:\Windows\explorer.exe Network Connect: 35.246.6.109 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.odysseysailingsantorini.com/cmsr/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /cmsr/?jtxXAR=f6Ad&4h0XO=aWr8NZzAm1//W065YDaH8MvMe5V7nlKazoNvd1fDio5dOX3Vx686XIFmrsqZJNrwHW47 HTTP/1.1Host: www.noseainsight.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cmsr/?4h0XO=cv8nmsgju4p54IaZtWrlOCmFaMIR/3kPtojHfoDwxQoDiPWi0/zmWdCsSN34zRZDM7Yr&jtxXAR=f6Ad HTTP/1.1Host: www.dorotajedrusik.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: z7d1ehQQQW.exe, 00000000.00000003.656320601.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: z7d1ehQQQW.exe, 00000000.00000003.655576379.0000000005AFF000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: z7d1ehQQQW.exe, 00000000.00000003.655576379.0000000005AFF000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comCe
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: z7d1ehQQQW.exe, 00000000.00000003.655576379.0000000005AFF000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comn-uL
Source: z7d1ehQQQW.exe, 00000000.00000003.655576379.0000000005AFF000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comt
Source: z7d1ehQQQW.exe, 00000000.00000003.655576379.0000000005AFF000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comw.c
Source: z7d1ehQQQW.exe, 00000000.00000003.659128745.0000000005AFF000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.co
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp, z7d1ehQQQW.exe, 00000000.00000003.664218437.0000000005B00000.00000004.00000001.sdmp, z7d1ehQQQW.exe, 00000000.00000003.658968542.0000000005AFF000.00000004.00000001.sdmp, z7d1ehQQQW.exe, 00000000.00000003.657880283.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: z7d1ehQQQW.exe, 00000000.00000003.657716958.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: z7d1ehQQQW.exe, 00000000.00000003.657716958.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/O
Source: z7d1ehQQQW.exe, 00000000.00000003.659434113.0000000005B00000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp, z7d1ehQQQW.exe, 00000000.00000003.658933536.0000000005AFF000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: z7d1ehQQQW.exe, 00000000.00000003.658881250.0000000005AFF000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.htmlO
Source: z7d1ehQQQW.exe, 00000000.00000003.660117823.0000000005B00000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers2I
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp, z7d1ehQQQW.exe, 00000000.00000003.658933536.0000000005AFF000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: z7d1ehQQQW.exe, 00000000.00000003.657764912.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersMF5
Source: z7d1ehQQQW.exe, 00000000.00000003.659553696.0000000005B00000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersW
Source: z7d1ehQQQW.exe, 00000000.00000003.657764912.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersd
Source: z7d1ehQQQW.exe, 00000000.00000003.657817317.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designerses-es_tradnl;
Source: z7d1ehQQQW.exe, 00000000.00000003.660082867.0000000005B00000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersn
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: z7d1ehQQQW.exe, 00000000.00000003.654997513.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn;
Source: z7d1ehQQQW.exe, 00000000.00000003.654997513.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnp
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp, z7d1ehQQQW.exe, 00000000.00000003.661245659.0000000005B00000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp, z7d1ehQQQW.exe, 00000000.00000003.656255820.0000000005ADB000.00000004.00000001.sdmp, z7d1ehQQQW.exe, 00000000.00000003.655831522.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: z7d1ehQQQW.exe, 00000000.00000003.656255820.0000000005ADB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/-czt
Source: z7d1ehQQQW.exe, 00000000.00000003.656255820.0000000005ADB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/1
Source: z7d1ehQQQW.exe, 00000000.00000003.656255820.0000000005ADB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/G
Source: z7d1ehQQQW.exe, 00000000.00000003.655831522.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/f
Source: z7d1ehQQQW.exe, 00000000.00000003.656255820.0000000005ADB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/i
Source: z7d1ehQQQW.exe, 00000000.00000003.656255820.0000000005ADB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: z7d1ehQQQW.exe, 00000000.00000003.656255820.0000000005ADB000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/f
Source: z7d1ehQQQW.exe, 00000000.00000003.655831522.0000000005AD4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/s-1
Source: z7d1ehQQQW.exe, 00000000.00000003.657056723.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.monotype.
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp, z7d1ehQQQW.exe, 00000000.00000003.656667821.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: z7d1ehQQQW.exe, 00000000.00000003.655730815.0000000005B00000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com0K
Source: z7d1ehQQQW.exe, 00000000.00000003.655730815.0000000005B00000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comlic
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: z7d1ehQQQW.exe, 00000000.00000003.660250458.0000000005B00000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.de
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: z7d1ehQQQW.exe, 00000000.00000003.657537776.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deF
Source: z7d1ehQQQW.exe, 00000000.00000003.657716958.0000000005AFE000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deold
Source: z7d1ehQQQW.exe, 00000000.00000002.680790183.0000000006D62000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: cscript.exe, 00000009.00000002.918829235.00000000052AF000.00000004.00020000.sdmp String found in binary or memory: https://www.dorotajedrusik.com/cmsr?4h0XO=cv8nmsgju4p54IaZtWrlOCmFaMIR%2F3kPtojHfoDwxQoDiPWi0%2FzmWd
Source: unknown DNS traffic detected: queries for: www.noseainsight.com
Source: global traffic HTTP traffic detected: GET /cmsr/?jtxXAR=f6Ad&4h0XO=aWr8NZzAm1//W065YDaH8MvMe5V7nlKazoNvd1fDio5dOX3Vx686XIFmrsqZJNrwHW47 HTTP/1.1Host: www.noseainsight.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cmsr/?4h0XO=cv8nmsgju4p54IaZtWrlOCmFaMIR/3kPtojHfoDwxQoDiPWi0/zmWdCsSN34zRZDM7Yr&jtxXAR=f6Ad HTTP/1.1Host: www.dorotajedrusik.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 5.2.z7d1ehQQQW.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.z7d1ehQQQW.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.699728442.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917024748.0000000000930000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.676864808.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735760553.00000000017D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917376978.0000000002990000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735028940.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917716659.0000000002D50000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.715863161.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735825753.0000000001810000.00000040.00020000.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 5.2.z7d1ehQQQW.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.z7d1ehQQQW.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.z7d1ehQQQW.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.z7d1ehQQQW.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.699728442.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.699728442.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.917024748.0000000000930000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.917024748.0000000000930000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.676864808.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.676864808.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.735760553.00000000017D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.735760553.00000000017D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.917376978.0000000002990000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.917376978.0000000002990000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.735028940.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.735028940.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.917716659.0000000002D50000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.917716659.0000000002D50000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.715863161.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.715863161.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.735825753.0000000001810000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.735825753.0000000001810000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: z7d1ehQQQW.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 5.2.z7d1ehQQQW.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.z7d1ehQQQW.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.z7d1ehQQQW.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.z7d1ehQQQW.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.699728442.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.699728442.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.917024748.0000000000930000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.917024748.0000000000930000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.676864808.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.676864808.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.735760553.00000000017D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.735760553.00000000017D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.917376978.0000000002990000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.917376978.0000000002990000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.735028940.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.735028940.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.917716659.0000000002D50000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.917716659.0000000002D50000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.715863161.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.715863161.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.735825753.0000000001810000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.735825753.0000000001810000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 0_2_00867C03 0_2_00867C03
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 0_2_0086502D 0_2_0086502D
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 0_2_02A8C124 0_2_02A8C124
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 0_2_02A8E562 0_2_02A8E562
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 0_2_02A8E570 0_2_02A8E570
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 0_2_00868831 0_2_00868831
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_0041E993 5_2_0041E993
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00402D8A 5_2_00402D8A
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00409E30 5_2_00409E30
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_0041DFD0 5_2_0041DFD0
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00E9502D 5_2_00E9502D
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00E97C03 5_2_00E97C03
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00E98831 5_2_00E98831
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CB090 9_2_048CB090
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C841F 9_2_048C841F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971002 9_2_04971002
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CD5E0 9_2_048CD5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BF900 9_2_048BF900
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B0D20 9_2_048B0D20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D4120 9_2_048D4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04981D55 9_2_04981D55
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D6E30 9_2_048D6E30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EEBB0 9_2_048EEBB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\cscript.exe Code function: String function: 048BB150 appears 32 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00419D50 NtCreateFile, 5_2_00419D50
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00419E00 NtReadFile, 5_2_00419E00
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00419E80 NtClose, 5_2_00419E80
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00419F30 NtAllocateVirtualMemory, 5_2_00419F30
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00419D4A NtCreateFile, 5_2_00419D4A
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00419E7C NtClose, 5_2_00419E7C
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00419F2A NtAllocateVirtualMemory, 5_2_00419F2A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9840 NtDelayExecution,LdrInitializeThunk, 9_2_048F9840
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9860 NtQuerySystemInformation,LdrInitializeThunk, 9_2_048F9860
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F99A0 NtCreateSection,LdrInitializeThunk, 9_2_048F99A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F95D0 NtClose,LdrInitializeThunk, 9_2_048F95D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 9_2_048F9910
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9540 NtReadFile,LdrInitializeThunk, 9_2_048F9540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F96D0 NtCreateKey,LdrInitializeThunk, 9_2_048F96D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F96E0 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_048F96E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9A50 NtCreateFile,LdrInitializeThunk, 9_2_048F9A50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9650 NtQueryValueKey,LdrInitializeThunk, 9_2_048F9650
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9660 NtAllocateVirtualMemory,LdrInitializeThunk, 9_2_048F9660
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9780 NtMapViewOfSection,LdrInitializeThunk, 9_2_048F9780
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9FE0 NtCreateMutant,LdrInitializeThunk, 9_2_048F9FE0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9710 NtQueryInformationToken,LdrInitializeThunk, 9_2_048F9710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F98A0 NtWriteVirtualMemory, 9_2_048F98A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F98F0 NtReadVirtualMemory, 9_2_048F98F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9820 NtEnumerateKey, 9_2_048F9820
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048FB040 NtSuspendThread, 9_2_048FB040
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F99D0 NtCreateProcessEx, 9_2_048F99D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F95F0 NtQueryInformationFile, 9_2_048F95F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9520 NtWaitForSingleObject, 9_2_048F9520
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048FAD30 NtSetContextThread, 9_2_048FAD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9950 NtQueueApcThread, 9_2_048F9950
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9560 NtWriteFile, 9_2_048F9560
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9A80 NtOpenDirectoryObject, 9_2_048F9A80
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9A00 NtProtectVirtualMemory, 9_2_048F9A00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9A10 NtQuerySection, 9_2_048F9A10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9610 NtEnumerateValueKey, 9_2_048F9610
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9A20 NtResumeThread, 9_2_048F9A20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9670 NtQueryInformationProcess, 9_2_048F9670
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F97A0 NtUnmapViewOfSection, 9_2_048F97A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048FA3B0 NtGetContextThread, 9_2_048FA3B0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9B00 NtSetValueKey, 9_2_048F9B00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048FA710 NtOpenProcessToken, 9_2_048FA710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9730 NtQueryVirtualMemory, 9_2_048F9730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9760 NtOpenProcess, 9_2_048F9760
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F9770 NtSetInformationFile, 9_2_048F9770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048FA770 NtOpenThread, 9_2_048FA770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_02D69E80 NtClose, 9_2_02D69E80
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_02D69E00 NtReadFile, 9_2_02D69E00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_02D69F30 NtAllocateVirtualMemory, 9_2_02D69F30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_02D69D50 NtCreateFile, 9_2_02D69D50
Sample file is different than original file name gathered from version info
Source: z7d1ehQQQW.exe, 00000000.00000002.681699947.0000000007280000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs z7d1ehQQQW.exe
Source: z7d1ehQQQW.exe, 00000000.00000002.674788458.000000000090A000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameFileBasedResourceGrovel.exe6 vs z7d1ehQQQW.exe
Source: z7d1ehQQQW.exe, 00000000.00000002.676276288.0000000002BE1000.00000004.00000001.sdmp Binary or memory string: OriginalFilename vs z7d1ehQQQW.exe
Source: z7d1ehQQQW.exe, 00000000.00000002.676276288.0000000002BE1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameColladaLoader.dll4 vs z7d1ehQQQW.exe
Source: z7d1ehQQQW.exe, 00000005.00000002.736099358.00000000019AF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs z7d1ehQQQW.exe
Source: z7d1ehQQQW.exe, 00000005.00000002.735136542.0000000000F3A000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameFileBasedResourceGrovel.exe6 vs z7d1ehQQQW.exe
Source: z7d1ehQQQW.exe, 00000005.00000002.736665067.0000000003520000.00000040.00020000.sdmp Binary or memory string: OriginalFilenamecscript.exe` vs z7d1ehQQQW.exe
Source: z7d1ehQQQW.exe Binary or memory string: OriginalFilenameFileBasedResourceGrovel.exe6 vs z7d1ehQQQW.exe
Source: z7d1ehQQQW.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: z7d1ehQQQW.exe Virustotal: Detection: 24%
Source: z7d1ehQQQW.exe ReversingLabs: Detection: 13%
Source: z7d1ehQQQW.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\z7d1ehQQQW.exe 'C:\Users\user\Desktop\z7d1ehQQQW.exe'
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process created: C:\Users\user\Desktop\z7d1ehQQQW.exe C:\Users\user\Desktop\z7d1ehQQQW.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cscript.exe
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\z7d1ehQQQW.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process created: C:\Users\user\Desktop\z7d1ehQQQW.exe C:\Users\user\Desktop\z7d1ehQQQW.exe Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\z7d1ehQQQW.exe' Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z7d1ehQQQW.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@3/2
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5072:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: z7d1ehQQQW.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: z7d1ehQQQW.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cscript.pdbUGP source: z7d1ehQQQW.exe, 00000005.00000002.736665067.0000000003520000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: z7d1ehQQQW.exe, 00000005.00000002.736099358.00000000019AF000.00000040.00000001.sdmp, cscript.exe, 00000009.00000002.918389183.00000000049AF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: z7d1ehQQQW.exe, 00000005.00000002.736099358.00000000019AF000.00000040.00000001.sdmp, cscript.exe
Source: Binary string: cscript.pdb source: z7d1ehQQQW.exe, 00000005.00000002.736665067.0000000003520000.00000040.00020000.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: z7d1ehQQQW.exe, CalendarId/MainForm.cs .Net Code: InitializeComponent System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 0_2_00867C03 push es; ret 0_2_00867F96
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_004178AB pushfd ; ret 5_2_004178AC
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_0040E27F push edx; iretd 5_2_0040E280
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00409BD5 push esp; iretd 5_2_00409BDC
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_004175F8 push edx; iretd 5_2_00417628
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00419DA2 pushad ; retf 5_2_00419DAB
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_0041660F push edx; iretd 5_2_00416610
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_0041CEF2 push eax; ret 5_2_0041CEF8
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_0041CEFB push eax; ret 5_2_0041CF62
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_0041CEA5 push eax; ret 5_2_0041CEF8
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_0041CF5C push eax; ret 5_2_0041CF62
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00E97C03 push es; ret 5_2_00E97F96
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0490D0D1 push ecx; ret 9_2_0490D0E4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_02D5E27F push edx; iretd 9_2_02D5E280
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_02D59BD5 push esp; iretd 9_2_02D59BDC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_02D678AB pushfd ; ret 9_2_02D678AC
Source: initial sample Static PE information: section name: .text entropy: 7.61448564553

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x89 0x9E 0xEF
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\cscript.exe Process created: /c del 'C:\Users\user\Desktop\z7d1ehQQQW.exe'
Source: C:\Windows\SysWOW64\cscript.exe Process created: /c del 'C:\Users\user\Desktop\z7d1ehQQQW.exe' Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.z7d1ehQQQW.exe.2d13274.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.676276288.0000000002BE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: z7d1ehQQQW.exe PID: 984, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: z7d1ehQQQW.exe, 00000000.00000002.676276288.0000000002BE1000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: z7d1ehQQQW.exe, 00000000.00000002.676276288.0000000002BE1000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe RDTSC instruction interceptor: First address: 0000000000409B4E second address: 0000000000409B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 0000000002D598E4 second address: 0000000002D598EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 0000000002D59B4E second address: 0000000002D59B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe TID: 3880 Thread sleep time: -41295s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe TID: 1288 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 3980 Thread sleep time: -46000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe TID: 6176 Thread sleep time: -50000s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00409A80 rdtsc 5_2_00409A80
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Thread delayed: delay time: 41295 Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000006.00000000.705078872.000000000FDAF000.00000004.00000001.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: z7d1ehQQQW.exe, 00000000.00000002.676276288.0000000002BE1000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.689058385.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: z7d1ehQQQW.exe, 00000000.00000002.676276288.0000000002BE1000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000006.00000000.699256456.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.689058385.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.764509665.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000006.00000000.689219732.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: z7d1ehQQQW.exe, 00000000.00000002.676276288.0000000002BE1000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000006.00000000.689219732.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000006.00000000.722338176.000000000FDD4000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Mail
Source: z7d1ehQQQW.exe, 00000000.00000002.676276288.0000000002BE1000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_00409A80 rdtsc 5_2_00409A80
Enables debug privileges
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B9080 mov eax, dword ptr fs:[00000030h] 9_2_048B9080
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04933884 mov eax, dword ptr fs:[00000030h] 9_2_04933884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04933884 mov eax, dword ptr fs:[00000030h] 9_2_04933884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C849B mov eax, dword ptr fs:[00000030h] 9_2_048C849B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F90AF mov eax, dword ptr fs:[00000030h] 9_2_048F90AF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EF0BF mov ecx, dword ptr fs:[00000030h] 9_2_048EF0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EF0BF mov eax, dword ptr fs:[00000030h] 9_2_048EF0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EF0BF mov eax, dword ptr fs:[00000030h] 9_2_048EF0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0494B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494B8D0 mov ecx, dword ptr fs:[00000030h] 9_2_0494B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0494B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0494B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0494B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0494B8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04988CD6 mov eax, dword ptr fs:[00000030h] 9_2_04988CD6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04936CF0 mov eax, dword ptr fs:[00000030h] 9_2_04936CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04936CF0 mov eax, dword ptr fs:[00000030h] 9_2_04936CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04936CF0 mov eax, dword ptr fs:[00000030h] 9_2_04936CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_049714FB mov eax, dword ptr fs:[00000030h] 9_2_049714FB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04937016 mov eax, dword ptr fs:[00000030h] 9_2_04937016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04937016 mov eax, dword ptr fs:[00000030h] 9_2_04937016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04937016 mov eax, dword ptr fs:[00000030h] 9_2_04937016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04984015 mov eax, dword ptr fs:[00000030h] 9_2_04984015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04984015 mov eax, dword ptr fs:[00000030h] 9_2_04984015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04971C06 mov eax, dword ptr fs:[00000030h] 9_2_04971C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0498740D mov eax, dword ptr fs:[00000030h] 9_2_0498740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0498740D mov eax, dword ptr fs:[00000030h] 9_2_0498740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0498740D mov eax, dword ptr fs:[00000030h] 9_2_0498740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04936C0A mov eax, dword ptr fs:[00000030h] 9_2_04936C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04936C0A mov eax, dword ptr fs:[00000030h] 9_2_04936C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04936C0A mov eax, dword ptr fs:[00000030h] 9_2_04936C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04936C0A mov eax, dword ptr fs:[00000030h] 9_2_04936C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EBC2C mov eax, dword ptr fs:[00000030h] 9_2_048EBC2C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CB02A mov eax, dword ptr fs:[00000030h] 9_2_048CB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CB02A mov eax, dword ptr fs:[00000030h] 9_2_048CB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CB02A mov eax, dword ptr fs:[00000030h] 9_2_048CB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CB02A mov eax, dword ptr fs:[00000030h] 9_2_048CB02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494C450 mov eax, dword ptr fs:[00000030h] 9_2_0494C450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494C450 mov eax, dword ptr fs:[00000030h] 9_2_0494C450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EA44B mov eax, dword ptr fs:[00000030h] 9_2_048EA44B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D0050 mov eax, dword ptr fs:[00000030h] 9_2_048D0050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D0050 mov eax, dword ptr fs:[00000030h] 9_2_048D0050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D746D mov eax, dword ptr fs:[00000030h] 9_2_048D746D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04972073 mov eax, dword ptr fs:[00000030h] 9_2_04972073
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04981074 mov eax, dword ptr fs:[00000030h] 9_2_04981074
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B2D8A mov eax, dword ptr fs:[00000030h] 9_2_048B2D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B2D8A mov eax, dword ptr fs:[00000030h] 9_2_048B2D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B2D8A mov eax, dword ptr fs:[00000030h] 9_2_048B2D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B2D8A mov eax, dword ptr fs:[00000030h] 9_2_048B2D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B2D8A mov eax, dword ptr fs:[00000030h] 9_2_048B2D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EA185 mov eax, dword ptr fs:[00000030h] 9_2_048EA185
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DC182 mov eax, dword ptr fs:[00000030h] 9_2_048DC182
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EFD9B mov eax, dword ptr fs:[00000030h] 9_2_048EFD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EFD9B mov eax, dword ptr fs:[00000030h] 9_2_048EFD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E61A0 mov eax, dword ptr fs:[00000030h] 9_2_048E61A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E61A0 mov eax, dword ptr fs:[00000030h] 9_2_048E61A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E35A1 mov eax, dword ptr fs:[00000030h] 9_2_048E35A1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E1DB5 mov eax, dword ptr fs:[00000030h] 9_2_048E1DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E1DB5 mov eax, dword ptr fs:[00000030h] 9_2_048E1DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E1DB5 mov eax, dword ptr fs:[00000030h] 9_2_048E1DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04968DF1 mov eax, dword ptr fs:[00000030h] 9_2_04968DF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BB1E1 mov eax, dword ptr fs:[00000030h] 9_2_048BB1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BB1E1 mov eax, dword ptr fs:[00000030h] 9_2_048BB1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BB1E1 mov eax, dword ptr fs:[00000030h] 9_2_048BB1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CD5E0 mov eax, dword ptr fs:[00000030h] 9_2_048CD5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CD5E0 mov eax, dword ptr fs:[00000030h] 9_2_048CD5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_049441E8 mov eax, dword ptr fs:[00000030h] 9_2_049441E8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B9100 mov eax, dword ptr fs:[00000030h] 9_2_048B9100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B9100 mov eax, dword ptr fs:[00000030h] 9_2_048B9100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B9100 mov eax, dword ptr fs:[00000030h] 9_2_048B9100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0493A537 mov eax, dword ptr fs:[00000030h] 9_2_0493A537
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04988D34 mov eax, dword ptr fs:[00000030h] 9_2_04988D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D4120 mov eax, dword ptr fs:[00000030h] 9_2_048D4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D4120 mov eax, dword ptr fs:[00000030h] 9_2_048D4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D4120 mov eax, dword ptr fs:[00000030h] 9_2_048D4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D4120 mov eax, dword ptr fs:[00000030h] 9_2_048D4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D4120 mov ecx, dword ptr fs:[00000030h] 9_2_048D4120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E513A mov eax, dword ptr fs:[00000030h] 9_2_048E513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E513A mov eax, dword ptr fs:[00000030h] 9_2_048E513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E4D3B mov eax, dword ptr fs:[00000030h] 9_2_048E4D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E4D3B mov eax, dword ptr fs:[00000030h] 9_2_048E4D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E4D3B mov eax, dword ptr fs:[00000030h] 9_2_048E4D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C3D34 mov eax, dword ptr fs:[00000030h] 9_2_048C3D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BAD30 mov eax, dword ptr fs:[00000030h] 9_2_048BAD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DB944 mov eax, dword ptr fs:[00000030h] 9_2_048DB944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DB944 mov eax, dword ptr fs:[00000030h] 9_2_048DB944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F3D43 mov eax, dword ptr fs:[00000030h] 9_2_048F3D43
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04933540 mov eax, dword ptr fs:[00000030h] 9_2_04933540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D7D50 mov eax, dword ptr fs:[00000030h] 9_2_048D7D50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BC962 mov eax, dword ptr fs:[00000030h] 9_2_048BC962
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BB171 mov eax, dword ptr fs:[00000030h] 9_2_048BB171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BB171 mov eax, dword ptr fs:[00000030h] 9_2_048BB171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DC577 mov eax, dword ptr fs:[00000030h] 9_2_048DC577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DC577 mov eax, dword ptr fs:[00000030h] 9_2_048DC577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494FE87 mov eax, dword ptr fs:[00000030h] 9_2_0494FE87
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048ED294 mov eax, dword ptr fs:[00000030h] 9_2_048ED294
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048ED294 mov eax, dword ptr fs:[00000030h] 9_2_048ED294
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B52A5 mov eax, dword ptr fs:[00000030h] 9_2_048B52A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B52A5 mov eax, dword ptr fs:[00000030h] 9_2_048B52A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B52A5 mov eax, dword ptr fs:[00000030h] 9_2_048B52A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B52A5 mov eax, dword ptr fs:[00000030h] 9_2_048B52A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B52A5 mov eax, dword ptr fs:[00000030h] 9_2_048B52A5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_049346A7 mov eax, dword ptr fs:[00000030h] 9_2_049346A7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CAAB0 mov eax, dword ptr fs:[00000030h] 9_2_048CAAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CAAB0 mov eax, dword ptr fs:[00000030h] 9_2_048CAAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04980EA5 mov eax, dword ptr fs:[00000030h] 9_2_04980EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04980EA5 mov eax, dword ptr fs:[00000030h] 9_2_04980EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04980EA5 mov eax, dword ptr fs:[00000030h] 9_2_04980EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EFAB0 mov eax, dword ptr fs:[00000030h] 9_2_048EFAB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E36CC mov eax, dword ptr fs:[00000030h] 9_2_048E36CC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F8EC7 mov eax, dword ptr fs:[00000030h] 9_2_048F8EC7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04988ED6 mov eax, dword ptr fs:[00000030h] 9_2_04988ED6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0496FEC0 mov eax, dword ptr fs:[00000030h] 9_2_0496FEC0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E16E0 mov ecx, dword ptr fs:[00000030h] 9_2_048E16E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C76E2 mov eax, dword ptr fs:[00000030h] 9_2_048C76E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C8A0A mov eax, dword ptr fs:[00000030h] 9_2_048C8A0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BC600 mov eax, dword ptr fs:[00000030h] 9_2_048BC600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BC600 mov eax, dword ptr fs:[00000030h] 9_2_048BC600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BC600 mov eax, dword ptr fs:[00000030h] 9_2_048BC600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048D3A1C mov eax, dword ptr fs:[00000030h] 9_2_048D3A1C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EA61C mov eax, dword ptr fs:[00000030h] 9_2_048EA61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EA61C mov eax, dword ptr fs:[00000030h] 9_2_048EA61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0496FE3F mov eax, dword ptr fs:[00000030h] 9_2_0496FE3F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BE620 mov eax, dword ptr fs:[00000030h] 9_2_048BE620
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04944257 mov eax, dword ptr fs:[00000030h] 9_2_04944257
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B9240 mov eax, dword ptr fs:[00000030h] 9_2_048B9240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B9240 mov eax, dword ptr fs:[00000030h] 9_2_048B9240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B9240 mov eax, dword ptr fs:[00000030h] 9_2_048B9240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B9240 mov eax, dword ptr fs:[00000030h] 9_2_048B9240
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C7E41 mov eax, dword ptr fs:[00000030h] 9_2_048C7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C7E41 mov eax, dword ptr fs:[00000030h] 9_2_048C7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C7E41 mov eax, dword ptr fs:[00000030h] 9_2_048C7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C7E41 mov eax, dword ptr fs:[00000030h] 9_2_048C7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C7E41 mov eax, dword ptr fs:[00000030h] 9_2_048C7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C7E41 mov eax, dword ptr fs:[00000030h] 9_2_048C7E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C766D mov eax, dword ptr fs:[00000030h] 9_2_048C766D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F927A mov eax, dword ptr fs:[00000030h] 9_2_048F927A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0496B260 mov eax, dword ptr fs:[00000030h] 9_2_0496B260
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0496B260 mov eax, dword ptr fs:[00000030h] 9_2_0496B260
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04988A62 mov eax, dword ptr fs:[00000030h] 9_2_04988A62
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DAE73 mov eax, dword ptr fs:[00000030h] 9_2_048DAE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DAE73 mov eax, dword ptr fs:[00000030h] 9_2_048DAE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DAE73 mov eax, dword ptr fs:[00000030h] 9_2_048DAE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DAE73 mov eax, dword ptr fs:[00000030h] 9_2_048DAE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DAE73 mov eax, dword ptr fs:[00000030h] 9_2_048DAE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C1B8F mov eax, dword ptr fs:[00000030h] 9_2_048C1B8F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C1B8F mov eax, dword ptr fs:[00000030h] 9_2_048C1B8F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04937794 mov eax, dword ptr fs:[00000030h] 9_2_04937794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04937794 mov eax, dword ptr fs:[00000030h] 9_2_04937794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04937794 mov eax, dword ptr fs:[00000030h] 9_2_04937794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0496D380 mov ecx, dword ptr fs:[00000030h] 9_2_0496D380
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048C8794 mov eax, dword ptr fs:[00000030h] 9_2_048C8794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0497138A mov eax, dword ptr fs:[00000030h] 9_2_0497138A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EB390 mov eax, dword ptr fs:[00000030h] 9_2_048EB390
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04985BA5 mov eax, dword ptr fs:[00000030h] 9_2_04985BA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048F37F5 mov eax, dword ptr fs:[00000030h] 9_2_048F37F5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EA70E mov eax, dword ptr fs:[00000030h] 9_2_048EA70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EA70E mov eax, dword ptr fs:[00000030h] 9_2_048EA70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494FF10 mov eax, dword ptr fs:[00000030h] 9_2_0494FF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0494FF10 mov eax, dword ptr fs:[00000030h] 9_2_0494FF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0497131B mov eax, dword ptr fs:[00000030h] 9_2_0497131B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0498070D mov eax, dword ptr fs:[00000030h] 9_2_0498070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_0498070D mov eax, dword ptr fs:[00000030h] 9_2_0498070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048DF716 mov eax, dword ptr fs:[00000030h] 9_2_048DF716
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B4F2E mov eax, dword ptr fs:[00000030h] 9_2_048B4F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048B4F2E mov eax, dword ptr fs:[00000030h] 9_2_048B4F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048EE730 mov eax, dword ptr fs:[00000030h] 9_2_048EE730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04988B58 mov eax, dword ptr fs:[00000030h] 9_2_04988B58
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BDB40 mov eax, dword ptr fs:[00000030h] 9_2_048BDB40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CEF40 mov eax, dword ptr fs:[00000030h] 9_2_048CEF40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BF358 mov eax, dword ptr fs:[00000030h] 9_2_048BF358
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048BDB60 mov ecx, dword ptr fs:[00000030h] 9_2_048BDB60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048CFF60 mov eax, dword ptr fs:[00000030h] 9_2_048CFF60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_04988F6A mov eax, dword ptr fs:[00000030h] 9_2_04988F6A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E3B7A mov eax, dword ptr fs:[00000030h] 9_2_048E3B7A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 9_2_048E3B7A mov eax, dword ptr fs:[00000030h] 9_2_048E3B7A
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Code function: 5_2_0040ACC0 LdrLoadDll, 5_2_0040ACC0
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.dorotajedrusik.com
Source: C:\Windows\explorer.exe Domain query: www.noseainsight.com
Source: C:\Windows\explorer.exe Network Connect: 35.246.6.109 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Section unmapped: C:\Windows\SysWOW64\cscript.exe base address: 1C0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Memory written: C:\Users\user\Desktop\z7d1ehQQQW.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Thread register set: target process: 3424 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Process created: C:\Users\user\Desktop\z7d1ehQQQW.exe C:\Users\user\Desktop\z7d1ehQQQW.exe Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\z7d1ehQQQW.exe' Jump to behavior
Source: explorer.exe, 00000006.00000000.676817795.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000006.00000000.762191972.0000000001080000.00000002.00020000.sdmp, cscript.exe, 00000009.00000002.917987042.0000000003140000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.762191972.0000000001080000.00000002.00020000.sdmp, cscript.exe, 00000009.00000002.917987042.0000000003140000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.762191972.0000000001080000.00000002.00020000.sdmp, cscript.exe, 00000009.00000002.917987042.0000000003140000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.762191972.0000000001080000.00000002.00020000.sdmp, cscript.exe, 00000009.00000002.917987042.0000000003140000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000006.00000000.689219732.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Users\user\Desktop\z7d1ehQQQW.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\z7d1ehQQQW.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 5.2.z7d1ehQQQW.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.z7d1ehQQQW.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.699728442.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917024748.0000000000930000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.676864808.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735760553.00000000017D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917376978.0000000002990000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735028940.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917716659.0000000002D50000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.715863161.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735825753.0000000001810000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 5.2.z7d1ehQQQW.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.z7d1ehQQQW.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.699728442.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917024748.0000000000930000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.676864808.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735760553.00000000017D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917376978.0000000002990000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735028940.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.917716659.0000000002D50000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.715863161.0000000006BF4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.735825753.0000000001810000.00000040.00020000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 491384 Sample: z7d1ehQQQW.exe Startdate: 27/09/2021 Architecture: WINDOWS Score: 100 31 www.healthyweathorganics.com 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 8 other signatures 2->45 11 z7d1ehQQQW.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\z7d1ehQQQW.exe.log, ASCII 11->29 dropped 57 Tries to detect virtualization through RDTSC time measurements 11->57 59 Injects a PE file into a foreign processes 11->59 15 z7d1ehQQQW.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 Queues an APC in another process (thread injection) 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 33 www.noseainsight.com 18->33 35 www.dorotajedrusik.com 18->35 37 5 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 cscript.exe 18->22         started        signatures11 process12 signatures13 49 Self deletion via cmd delete 22->49 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
35.246.6.109
 td-balancer-euw2-6-109.wixdns.net United States
15169 GOOGLEUS false
34.102.136.180
 noseainsight.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
td-balancer-euw2-6-109.wixdns.net 35.246.6.109 true
noseainsight.com 34.102.136.180 true
www.healthyweathorganics.com 47.91.170.222 true
www.dorotajedrusik.com unknown unknown
www.noseainsight.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.noseainsight.com/cmsr/?jtxXAR=f6Ad&4h0XO=aWr8NZzAm1//W065YDaH8MvMe5V7nlKazoNvd1fDio5dOX3Vx686XIFmrsqZJNrwHW47 false
  • Avira URL Cloud: malware
 unknown
www.odysseysailingsantorini.com/cmsr/ true
  • Avira URL Cloud: safe
 low
http://www.dorotajedrusik.com/cmsr/?4h0XO=cv8nmsgju4p54IaZtWrlOCmFaMIR/3kPtojHfoDwxQoDiPWi0/zmWdCsSN34zRZDM7Yr&jtxXAR=f6Ad false
  • Avira URL Cloud: safe
 unknown