Windows Analysis Report AfWu3i35ny.exe

AV Detection:

Found malware configuration

Source: 00000001.00000002.39989546957.0000000002260000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "http://45.137.22.91/blm.bin"}

Multi AV Scanner detection for submitted file

Source: AfWu3i35ny.exe

Virustotal: Detection: 40%

Perma Link

Yara detected FormBook

Source: Yara match	File source: AfWu3i35ny.exe, type: SAMPLE
Source: Yara match	File source: 9.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.40357172124.000000001E354000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.39596077023.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.39985785397.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.39988281368.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\AfWu3i35ny.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe, type: DROPPED

Antivirus / Scanner detection for submitted sample

Source: AfWu3i35ny.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe

ReversingLabs: Detection: 38%

Antivirus or Machine Learning detection for unpacked file

Source: 1.0.AfWu3i35ny.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen2
Source: 9.0.AfWu3i35ny.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen2
Source: 1.2.AfWu3i35ny.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen2

Compliance:

Uses 32bit PE files

Source: AfWu3i35ny.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Binary contains paths to debug symbols

Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062, source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\7 source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40578435874.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u301\1513\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: javaw.exe0.9.dr
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A9 source: AfWu3i35ny.exe, 00000009.00000003.40678258355.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: =C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.40449880217.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\7 source: AfWu3i35ny.exe, 00000009.00000003.41239946368.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\0 source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40590591634.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\@ source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb R7 source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991 source: AfWu3i35ny.exe, 00000009.00000003.40449880217.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40678039686.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Perforce\FRMain\code\build\win\results\Release\info\arh.pdb source: arh.exe.9.dr
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE760625 source: AfWu3i35ny.exe, 00000009.00000003.40800244375.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40800244375.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40678039686.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: ADelRCP_Exec.pdb777 source: ADelRCP.exe.9.dr
Source:	Binary string: TEST_mi_exe_stub.pdb source: GoogleUpdateSetup.exe.9.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbti source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062( source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40639518936.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*hp6 source: AfWu3i35ny.exe, 00000009.00000003.40578435874.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ta@ source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*p source: AfWu3i35ny.exe, 00000009.00000003.40535307045.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\a\ source: AfWu3i35ny.exe, 00000009.00000003.40744193776.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: WINLOA~1.PDB source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\6 source: AfWu3i35ny.exe, 00000009.00000003.41355274902.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*X 7 source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: GoogleCrashHandler_unsigned.pdb source: GoogleCrashHandler.exe.9.dr
Source:	Binary string: msedge_pwa_launcher.exe.pdb source: msedge_pwa_launcher.exe.9.dr
Source:	Binary string: VSTOInstaller.pdb source: VSTOInstaller.exe.9.dr
Source:	Binary string: WINLOA~1.PDB,7 source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: ocuments and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40678039686.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41355030593.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: GoogleCrashHandler_unsigned.pdbb source: GoogleCrashHandler.exe.9.dr
Source:	Binary string: lication Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40449914957.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: xLC:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76 source: AfWu3i35ny.exe, 00000009.00000003.40744193776.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: n Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ source: AfWu3i35ny.exe, 00000009.00000003.40650108505.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*.* source: AfWu3i35ny.exe, 00000009.00000003.40563649462.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: MpCmdRun.pdbGCTL source: MpCmdRun.exe0.9.dr
Source:	Binary string: WINLOA~1.PDBl source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: GoogleUpdateBroker_unsigned.pdb source: GoogleUpdateBroker.exe.9.dr
Source:	Binary string: xLC:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE760 source: AfWu3i35ny.exe, 00000009.00000003.40549320972.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40766478715.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40590591634.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40449914957.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40800244375.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: >\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40650166144.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.40449880217.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: ConfigSecurityPolicy.pdbGCTL source: ConfigSecurityPolicy.exe.9.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb7 source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*@$(6 source: AfWu3i35ny.exe, 00000009.00000003.40639518936.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 D source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb ^7 source: AfWu3i35ny.exe, 00000009.00000003.40447217364.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u301\1513\build\windows-i586\jdk\objs\java_objs\java.pdb source: java.exe.9.dr
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991 source: AfWu3i35ny.exe, 00000009.00000003.41314351731.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.41314543259.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: AfWu3i35ny.exe, 00000009.00000003.40650299796.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40590493911.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40744193776.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.41239946368.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41355274902.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40450056794.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: setup.exe.pdb source: setup.exe0.9.dr
Source:	Binary string: oad_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: WINLOA~1.PDBP5 source: AfWu3i35ny.exe, 00000009.00000003.40590493911.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*D>7 source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: D:\B\T\BuildResults\bin\Release\chrome_wow_helper.pdb source: wow_helper.exe.9.dr
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\@ source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.41239946368.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40578435874.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40744193776.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: WINLOA~1.PDB| source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76 source: AfWu3i35ny.exe, 00000009.00000003.40744193776.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: >\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.40650108505.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: msedge.exe.pdb source: msedge.exe.9.dr
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*6 source: AfWu3i35ny.exe, 00000009.00000003.40717903047.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*.* source: AfWu3i35ny.exe, 00000009.00000003.40447110878.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: ConfigSecurityPolicy.pdb source: ConfigSecurityPolicy.exe.9.dr
Source:	Binary string: a\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40650166144.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: winload_prod.pdb56 source: AfWu3i35ny.exe, 00000009.00000003.40535162153.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: &oad_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ source: AfWu3i35ny.exe, 00000009.00000003.40449880217.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: ADelRCP.exe.9.dr
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE760 source: AfWu3i35ny.exe, 00000009.00000003.40549320972.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40800030890.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\6 source: AfWu3i35ny.exe, 00000009.00000003.40590591634.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE760626 source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\F3 source: AfWu3i35ny.exe, 00000009.00000003.40578435874.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: LC:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*, source: AfWu3i35ny.exe, 00000009.00000003.41244552310.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: AfWu3i35ny.exe, 00000009.00000003.40447217364.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40650299796.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\\U,=7 source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\5 source: AfWu3i35ny.exe, 00000009.00000003.40800244375.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: cation Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314258975.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: \Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40650166144.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: tion Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.41314704625.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41314543259.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062Da source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: <pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314543259.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40650299796.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: @H8pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40449914957.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*ti source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: %C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb5 source: AfWu3i35ny.exe, 00000009.00000003.41404837349.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314543259.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40450056794.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: @x=C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40449914957.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: ocuments and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\4 source: AfWu3i35ny.exe, 00000009.00000003.40678039686.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40678039686.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*p source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*.* source: AfWu3i35ny.exe, 00000009.00000003.41239946368.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Temp\Symbols\winload_prod.pdb\*.*` source: AfWu3i35ny.exe, 00000009.00000003.40611750075.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*at source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40717903047.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: @$<pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314351731.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\6 source: AfWu3i35ny.exe, 00000009.00000003.41314704625.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: MpCmdRun.pdb source: MpCmdRun.exe0.9.dr
Source:	Binary string: ^C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*5 source: AfWu3i35ny.exe, 00000009.00000003.40800030890.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*, source: AfWu3i35ny.exe, 00000009.00000003.41244552310.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARM.pdb source: AdobeARM.exe.9.dr
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\a\ source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: winload_prod.pdbC6 source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: @;C:\Documents and Settings\user\AppData\Local\Temp\Symbols\winload_prod.pdb\*.*`G source: AfWu3i35ny.exe, 00000009.00000003.40611750075.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb6 source: AfWu3i35ny.exe, 00000009.00000003.40650299796.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.41404837349.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062X;7 source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: WINLOA~1.PDBL6 source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: WINLOA~1.PDBm6 source: AfWu3i35ny.exe, 00000009.00000003.40766478715.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ source: AfWu3i35ny.exe, 00000009.00000003.41314351731.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40535307045.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314351731.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE7606\@ source: AfWu3i35ny.exe, 00000009.00000003.40496305564.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: \Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.40650108505.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40650299796.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*r\ source: AfWu3i35ny.exe, 00000009.00000003.41355030593.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: 7Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: lication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbh source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: winload_prod.pdbd source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.41314704625.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: V@winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40800030890.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: V@winload_prod.pdb"6 source: AfWu3i35ny.exe, 00000009.00000003.40717903047.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\20 source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: ta\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314448307.000000001E370000.00000004.00000001.sdmp

Spreading:

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\javaw.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeGenuineSlimInstaller.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\cookie_exporter.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdateCore.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\javaws.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\msedgewebview2.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\notification_helper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\msedge_proxy.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\X86\MpCmdRun.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\jp2launcher.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\identity_helper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0\ConfigSecurityPolicy.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdateComRegisterShell64.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\unpack200.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleCrashHandler.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80923375\javaws.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80923375\javaw.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleCrashHandler64.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\Installer\setup.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\java.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\ssvagent.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdate.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdateOnDemand.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\Acrobat\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80923375\java.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\elevation_service.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\msedge_pwa_launcher.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0\X86\MpCmdRun.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\msedge.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\pwahelper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\javacpl.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\BHO\ie_to_edge_stub.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdateBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdateSetup.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe			Jump to behavior

Enumerates the file system

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\Application Data\			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\			Jump to behavior

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2018752 ET TROJAN Generic .bin download from Dotted Quad 192.168.11.20:49800 -> 45.137.22.91:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://45.137.22.91/blm.bin

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /blm.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 45.137.22.91Cache-Control: no-cache

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.91

URLs found in memory or binary data

Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: jusched.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Au3Check.exe.9.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Au3Check.exe.9.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Au3Check.exe.9.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Au3Check.exe.9.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: arh.exe.9.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: jusched.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: jusched.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: jusched.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: jusched.exe.9.dr	String found in binary or memory: http://es5.github.io/#x15.4.4.21
Source: arh.exe.9.dr	String found in binary or memory: http://evcs-aia.ws.symantec.com/evcs.cer0
Source: arh.exe.9.dr	String found in binary or memory: http://evcs-crl.ws.symantec.com/evcs.crl0
Source: arh.exe.9.dr	String found in binary or memory: http://evcs-ocsp.ws.symantec.com04
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: GoogleCrashHandler.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0L
Source: jusched.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: arh.exe.9.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: Au3Check.exe.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Au3Check.exe.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Au3Check.exe.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Au3Check.exe.9.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Au3Check.exe.9.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: jusched.exe.9.dr	String found in binary or memory: http://stackoverflow.com/a/1465386/4224163
Source: jusched.exe.9.dr	String found in binary or memory: http://stackoverflow.com/a/15123777)
Source: jusched.exe.9.dr	String found in binary or memory: http://stackoverflow.com/questions/1026069/capitalize-the-first-letter-of-string-in-javascript
Source: jusched.exe.9.dr	String found in binary or memory: http://stackoverflow.com/questions/1068834/object-comparison-in-javascript
Source: arh.exe.9.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: arh.exe.9.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: arh.exe.9.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.activestate.com
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.activestate.comJames
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/scite
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.baanboard.com
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.baanboard.comPraveen
Source: jusched.exe.9.dr	String found in binary or memory: http://www.computerhope.com/forum/index.php?topic=76293.0
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.develop.com
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.develop.comYann
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: ADelRCP.exe.9.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.lua.org
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.rftp.com
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.rftp.comSteve
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.scintila.org/scite.rng
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.scintilla.org
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.spaceblue.com
Source: SciTE.exe.9.dr	String found in binary or memory: http://www.spaceblue.comDenis
Source: arh.exe.9.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: arh.exe.9.dr	String found in binary or memory: http://www.symauth.com/cps09
Source: arh.exe.9.dr	String found in binary or memory: http://www.symauth.com/rpa04
Source: jusched.exe.9.dr	String found in binary or memory: http://www.tutorialspoint.com/javascript/array_map.htm
Source: msedge.exe.9.dr	String found in binary or memory: https://crashpad.chromium.org/
Source: msedge.exe.9.dr	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: msedge.exe.9.dr	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: jusched.exe.9.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/Reduce
Source: jusched.exe.9.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/filter
Source: jusched.exe.9.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/indexOf
Source: jusched.exe.9.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/Trim
Source: jusched.exe.9.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
Source: jusched.exe.9.dr	String found in binary or memory: https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
Source: jusched.exe.9.dr	String found in binary or memory: https://javadl-esd-secure.oracle.com/update/%s/map-%s.xml
Source: jusched.exe.9.dr	String found in binary or memory: https://javadl-esd-secure.oracle.com/update/%s/map-%s.xmlNo
Source: Au3Check.exe.9.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: ADelRCP.exe.9.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Au3Check.exe.9.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Au3Check.exe.9.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /blm.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 45.137.22.91Cache-Control: no-cache

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a raw input device (often for capturing keystrokes)

Source: AfWu3i35ny.exe, 00000009.00000003.40964757610.000000001E420000.00000004.00000001.sdmp

Binary or memory string: _WinAPI_RegisterRawInputDevices.au3

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: AfWu3i35ny.exe, type: SAMPLE
Source: Yara match	File source: 9.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.40357172124.000000001E354000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.39596077023.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.39985785397.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.39988281368.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\AfWu3i35ny.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe, type: DROPPED

System Summary:

Potential malicious icon found

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Malicious sample detected (through community Yara rule)

Source: AfWu3i35ny.exe, type: SAMPLE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: AfWu3i35ny.exe, type: SAMPLE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000003.40357172124.000000001E354000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000003.40357172124.000000001E354000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.39596077023.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.39596077023.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.39985785397.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.39985785397.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.39988281368.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.39988281368.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: C:\Users\user\AppData\Local\Temp\3582-490\AfWu3i35ny.exe, type: DROPPED	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\3582-490\AfWu3i35ny.exe, type: DROPPED	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe, type: DROPPED	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe, type: DROPPED	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com

Uses 32bit PE files

Source: AfWu3i35ny.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Yara signature match

Source: AfWu3i35ny.exe, type: SAMPLE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: AfWu3i35ny.exe, type: SAMPLE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000003.40357172124.000000001E354000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000003.40357172124.000000001E354000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.39596077023.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.39596077023.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.39985785397.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.39985785397.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.39988281368.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.39988281368.0000000000401000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: C:\Users\user\AppData\Local\Temp\3582-490\AfWu3i35ny.exe, type: DROPPED	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\user\AppData\Local\Temp\3582-490\AfWu3i35ny.exe, type: DROPPED	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe, type: DROPPED	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe, type: DROPPED	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE

Creates files inside the system directory

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

File created: C:\Windows\svchost.com

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0043802D		1_2_0043802D
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0043212D		1_2_0043212D
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0043234D		1_2_0043234D
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_004303CD		1_2_004303CD
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_00421E50		1_2_00421E50
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_00422F20		1_2_00422F20
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_022683BA		1_2_022683BA
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226C05A		1_2_0226C05A
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02266CC4		1_2_02266CC4
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226C286		1_2_0226C286
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226B284		1_2_0226B284
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226834B		1_2_0226834B
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02266872		1_2_02266872
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02268840		1_2_02268840
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226708B		1_2_0226708B
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02268892		1_2_02268892
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_022688EC		1_2_022688EC
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226B0FC		1_2_0226B0FC
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226C0F8		1_2_0226C0F8
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02267934		1_2_02267934
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_022669A6		1_2_022669A6
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02266672		1_2_02266672
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226768A		1_2_0226768A
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226AEE9		1_2_0226AEE9
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226B737		1_2_0226B737
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02268706		1_2_02268706
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02267773		1_2_02267773
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02267740		1_2_02267740
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02267757		1_2_02267757
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226B4D8		1_2_0226B4D8
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226A564		1_2_0226A564

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Code function: String function: 0040177E appears 94 times

Contains functionality to call native functions

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226BB25 NtProtectVirtualMemory,		1_2_0226BB25
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_022683BA NtAllocateVirtualMemory,		1_2_022683BA
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02266CC4 NtWriteVirtualMemory,		1_2_02266CC4
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226834B NtWriteVirtualMemory,		1_2_0226834B
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226708B NtWriteVirtualMemory,LoadLibraryA,		1_2_0226708B
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02267934 NtWriteVirtualMemory,		1_2_02267934
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226768A NtWriteVirtualMemory,		1_2_0226768A
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226AEE9 NtWriteVirtualMemory,		1_2_0226AEE9
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02267773 NtWriteVirtualMemory,		1_2_02267773
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02267740 NtWriteVirtualMemory,		1_2_02267740
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02267757 NtWriteVirtualMemory,		1_2_02267757
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226A564 NtWriteVirtualMemory,		1_2_0226A564

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Process Stats: CPU usage > 98%

Sample file is different than original file name gathered from version info

Source: AfWu3i35ny.exe, 00000001.00000000.39596476896.0000000000446000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDikter.exe vs AfWu3i35ny.exe
Source: AfWu3i35ny.exe, 00000001.00000002.39989831235.0000000002330000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDikter.exeFE2X vs AfWu3i35ny.exe
Source: AfWu3i35ny.exe, 00000009.00000000.39986137327.0000000000446000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDikter.exe vs AfWu3i35ny.exe
Source: AfWu3i35ny.exe	Binary or memory string: OriginalFilenameDikter.exe vs AfWu3i35ny.exe

PE file contains strange resources

Source: AfWu3i35ny.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SEMILEAFL.exe.9.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Tries to load missing DLLs

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Section loaded: edgegdi.dll			Jump to behavior

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe 740A2BC7E9C8EEED76EF0F812C6C89AF35C414317D76AC5B50B28CA0728D103B

Sample is known by Antivirus

Source: AfWu3i35ny.exe

Virustotal: Detection: 40%

Sample reads its own file content

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

File read: C:\Users\user\Desktop\AfWu3i35ny.exe

Jump to behavior

PE file has an executable .text section and no other executable section

Source: AfWu3i35ny.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\AfWu3i35ny.exe 'C:\Users\user\Desktop\AfWu3i35ny.exe'
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process created: C:\Users\user\Desktop\AfWu3i35ny.exe 'C:\Users\user\Desktop\AfWu3i35ny.exe'
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process created: C:\Users\user\Desktop\AfWu3i35ny.exe 'C:\Users\user\Desktop\AfWu3i35ny.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

File created: C:\Users\user\AppData\Local\Temp\ELECIVESB

Jump to behavior

Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)

Source: msedge.exe.9.dr

Binary string: ntdll.dllHKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_PERFORMANCE_DATAHKEY_PERFORMANCE_TEXTHKEY_PERFORMANCE_NLSTEXTHKEY_CURRENT_CONFIGHKEY_DYN_DATA\Device\\Device\HarddiskVolumentdll.dllEventFileALPC Port../../sandbox/win/src/sandbox_policy_base.ccFailed to add sandbox rule. error = , subsystem = , semantics = , pattern = '`1(@

Source: msedge.exe.9.dr

Binary string: clone converter %s at %p into stackBuffer %pclose converter %s at %p, isCopyLocal=%bjaKeyg_handles_to_closeverifier.dllsbox_alternate_desktop_local_winstation_0x%X@g_interceptionsntdll.dllNtMapViewOfSectionNtUnmapViewOfSectiong_originalsntdll.dllNtAllocateVirtualMemoryNtDuplicateObjectNtFreeVirtualMemoryNtProtectVirtualMemoryNtQueryVirtualMemoryNtSignalAndWaitForSingleObjectNtWaitForSingleObjectRtlAllocateHeapRtlAnsiStringToUnicodeStringRtlCompareUnicodeStringRtlCreateHeapRtlCreateUserThreadRtlDestroyHeapRtlFreeHeap_strnicmpstrlenwcslenmemcpyg_ntNtSetInformationThreadNtOpenThreadTokenNtOpenThreadTokenExkernel32.dll\Device\\/?/?\**~*\/?/?\\??\NtOpenDirectoryObjectNtQuerySymbolicLinkObjectNtOpenSymbolicLinkObject\Sessions\BNOLINKSNtCreateEventNtOpenEvent

Classification label

Source: classification engine

Classification label: mal100.rans.spre.troj.evad.winEXE@4/78@0/1

Reads ini files

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Creates mutexes

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Mutant created: \Sessions\1\BaseNamedObjects\MutexPolesskayaGlush*.* svchost.com n X . t N t h ` T 5 @

Binary contains paths to debug symbols

Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062, source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\7 source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40578435874.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u301\1513\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: javaw.exe0.9.dr
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A9 source: AfWu3i35ny.exe, 00000009.00000003.40678258355.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: =C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.40449880217.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\7 source: AfWu3i35ny.exe, 00000009.00000003.41239946368.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\0 source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40590591634.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\@ source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb R7 source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991 source: AfWu3i35ny.exe, 00000009.00000003.40449880217.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40678039686.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Perforce\FRMain\code\build\win\results\Release\info\arh.pdb source: arh.exe.9.dr
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE760625 source: AfWu3i35ny.exe, 00000009.00000003.40800244375.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40800244375.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40678039686.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: ADelRCP_Exec.pdb777 source: ADelRCP.exe.9.dr
Source:	Binary string: TEST_mi_exe_stub.pdb source: GoogleUpdateSetup.exe.9.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdbti source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062( source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40639518936.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*hp6 source: AfWu3i35ny.exe, 00000009.00000003.40578435874.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ta@ source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*p source: AfWu3i35ny.exe, 00000009.00000003.40535307045.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\a\ source: AfWu3i35ny.exe, 00000009.00000003.40744193776.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: WINLOA~1.PDB source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\6 source: AfWu3i35ny.exe, 00000009.00000003.41355274902.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*X 7 source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: GoogleCrashHandler_unsigned.pdb source: GoogleCrashHandler.exe.9.dr
Source:	Binary string: msedge_pwa_launcher.exe.pdb source: msedge_pwa_launcher.exe.9.dr
Source:	Binary string: VSTOInstaller.pdb source: VSTOInstaller.exe.9.dr
Source:	Binary string: WINLOA~1.PDB,7 source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: ocuments and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40678039686.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41355030593.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: GoogleCrashHandler_unsigned.pdbb source: GoogleCrashHandler.exe.9.dr
Source:	Binary string: lication Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40449914957.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: xLC:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76 source: AfWu3i35ny.exe, 00000009.00000003.40744193776.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: n Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ source: AfWu3i35ny.exe, 00000009.00000003.40650108505.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*.* source: AfWu3i35ny.exe, 00000009.00000003.40563649462.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: MpCmdRun.pdbGCTL source: MpCmdRun.exe0.9.dr
Source:	Binary string: WINLOA~1.PDBl source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: GoogleUpdateBroker_unsigned.pdb source: GoogleUpdateBroker.exe.9.dr
Source:	Binary string: xLC:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE760 source: AfWu3i35ny.exe, 00000009.00000003.40549320972.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40766478715.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40590591634.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40449914957.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40800244375.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: >\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40650166144.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.40449880217.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: ConfigSecurityPolicy.pdbGCTL source: ConfigSecurityPolicy.exe.9.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb7 source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*@$(6 source: AfWu3i35ny.exe, 00000009.00000003.40639518936.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 D source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb ^7 source: AfWu3i35ny.exe, 00000009.00000003.40447217364.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u301\1513\build\windows-i586\jdk\objs\java_objs\java.pdb source: java.exe.9.dr
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991 source: AfWu3i35ny.exe, 00000009.00000003.41314351731.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.41314543259.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: AfWu3i35ny.exe, 00000009.00000003.40650299796.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40590493911.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40744193776.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.41239946368.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41355274902.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40450056794.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: setup.exe.pdb source: setup.exe0.9.dr
Source:	Binary string: oad_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: WINLOA~1.PDBP5 source: AfWu3i35ny.exe, 00000009.00000003.40590493911.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*D>7 source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: D:\B\T\BuildResults\bin\Release\chrome_wow_helper.pdb source: wow_helper.exe.9.dr
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\@ source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.41239946368.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40578435874.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40744193776.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: WINLOA~1.PDB| source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76 source: AfWu3i35ny.exe, 00000009.00000003.40744193776.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: >\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.40650108505.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: msedge.exe.pdb source: msedge.exe.9.dr
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*6 source: AfWu3i35ny.exe, 00000009.00000003.40717903047.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*.* source: AfWu3i35ny.exe, 00000009.00000003.40447110878.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: ConfigSecurityPolicy.pdb source: ConfigSecurityPolicy.exe.9.dr
Source:	Binary string: a\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40650166144.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: winload_prod.pdb56 source: AfWu3i35ny.exe, 00000009.00000003.40535162153.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: &oad_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ source: AfWu3i35ny.exe, 00000009.00000003.40449880217.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: ADelRCP.exe.9.dr
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE760 source: AfWu3i35ny.exe, 00000009.00000003.40549320972.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40800030890.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\6 source: AfWu3i35ny.exe, 00000009.00000003.40590591634.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE760626 source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\F3 source: AfWu3i35ny.exe, 00000009.00000003.40578435874.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: LC:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*, source: AfWu3i35ny.exe, 00000009.00000003.41244552310.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb source: AfWu3i35ny.exe, 00000009.00000003.40447217364.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40650299796.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\\U,=7 source: AfWu3i35ny.exe, 00000009.00000003.41253330350.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\5 source: AfWu3i35ny.exe, 00000009.00000003.40800244375.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: cation Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314258975.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: \Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40650166144.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: tion Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.41314704625.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.41314543259.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062Da source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: <pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314543259.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40650299796.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: @H8pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40449914957.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*ti source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: %C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb5 source: AfWu3i35ny.exe, 00000009.00000003.41404837349.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314543259.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40450056794.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: @x=C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40449914957.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: ocuments and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\4 source: AfWu3i35ny.exe, 00000009.00000003.40678039686.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40678039686.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*p source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*.* source: AfWu3i35ny.exe, 00000009.00000003.41239946368.000000001E374000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Temp\Symbols\winload_prod.pdb\*.*` source: AfWu3i35ny.exe, 00000009.00000003.40611750075.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*at source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40717903047.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: @$<pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314351731.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\6 source: AfWu3i35ny.exe, 00000009.00000003.41314704625.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: MpCmdRun.pdb source: MpCmdRun.exe0.9.dr
Source:	Binary string: ^C:\Documents and Settings\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*5 source: AfWu3i35ny.exe, 00000009.00000003.40800030890.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*, source: AfWu3i35ny.exe, 00000009.00000003.41244552310.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARM.pdb source: AdobeARM.exe.9.dr
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\a\ source: AfWu3i35ny.exe, 00000009.00000003.41244697103.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: winload_prod.pdbC6 source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: @;C:\Documents and Settings\user\AppData\Local\Temp\Symbols\winload_prod.pdb\*.*`G source: AfWu3i35ny.exe, 00000009.00000003.40611750075.000000001E358000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb6 source: AfWu3i35ny.exe, 00000009.00000003.40650299796.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.41404837349.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.41297402589.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40459940102.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062X;7 source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: WINLOA~1.PDBL6 source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: WINLOA~1.PDBm6 source: AfWu3i35ny.exe, 00000009.00000003.40766478715.000000001E360000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ source: AfWu3i35ny.exe, 00000009.00000003.41314351731.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40535307045.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: pplication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314351731.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE7606\@ source: AfWu3i35ny.exe, 00000009.00000003.40496305564.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: \Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\*.* source: AfWu3i35ny.exe, 00000009.00000003.40650108505.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40650299796.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.*r\ source: AfWu3i35ny.exe, 00000009.00000003.41355030593.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: 7Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\*.* source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: lication Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdbh source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: winload_prod.pdbd source: AfWu3i35ny.exe, 00000009.00000003.40693379373.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062 source: AfWu3i35ny.exe, 00000009.00000003.40563753225.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\ source: AfWu3i35ny.exe, 00000009.00000003.40623746535.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40516264118.000000001E368000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.41314704625.000000001E36C000.00000004.00000001.sdmp
Source:	Binary string: V@winload_prod.pdb source: AfWu3i35ny.exe, 00000009.00000003.40800030890.000000001E35C000.00000004.00000001.sdmp
Source:	Binary string: V@winload_prod.pdb"6 source: AfWu3i35ny.exe, 00000009.00000003.40717903047.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AfWu3i35ny.exe, 00000009.00000003.40470580173.000000001E370000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\20 source: AfWu3i35ny.exe, 00000009.00000003.41405013424.000000001E364000.00000004.00000001.sdmp
Source:	Binary string: ta\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*.* source: AfWu3i35ny.exe, 00000009.00000003.41314448307.000000001E370000.00000004.00000001.sdmp

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000001.00000002.39989546957.0000000002260000.00000040.00000001.sdmp, type: MEMORY

Yara detected VB6 Downloader Generic

Source: Yara match

File source: Process Memory Space: AfWu3i35ny.exe PID: 8080, type: MEMORYSTR

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_00402070 push ebx; iretd		1_2_004020D4
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0040F87D push ds; ret		1_2_0040F8A3
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_004059C4 push cs; iretw		1_2_004059FA
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_00421DAF push eax; ret		1_2_00421DB5
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_00421E19 push eax; ret		1_2_00421E1F
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226027E push ds; iretd		1_2_02260391
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226924B push cs; iretd		1_2_0226924C
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226030C push ds; iretd		1_2_02260391
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02260392 push ds; iretd		1_2_02260391
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_022619D9 push 00000019h; retn 9E34h		1_2_02261AC8
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226767C push ds; iretd		1_2_02267688
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02261F50 push ebp; ret		1_2_02261F64
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02264FB9 pushfd ; iretd		1_2_02264FC4
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02269420 push ebx; ret		1_2_0226942E
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 9_3_1E36C0CF push ds; iretd		9_3_1E36C0D0

PE file contains sections with non-standard names

Source: unpack200.exe.9.dr

Static PE information: section name: .00cfg

PE file contains an invalid checksum

Source: unpack200.exe.9.dr

Static PE information: real checksum: 0x2c3c4 should be: 0x3edf5

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: .text entropy: 7.17479842318
Source: initial sample	Static PE information: section name: .text entropy: 7.17479842318

Persistence and Installation Behavior:

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\javaw.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeGenuineSlimInstaller.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\cookie_exporter.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdateCore.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\javaws.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\msedgewebview2.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\notification_helper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\msedge_proxy.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\X86\MpCmdRun.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\jp2launcher.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\identity_helper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0\ConfigSecurityPolicy.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdateComRegisterShell64.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\unpack200.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleCrashHandler.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80923375\javaws.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80923375\javaw.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleCrashHandler64.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\Installer\setup.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\java.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\ssvagent.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdate.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdateOnDemand.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\Acrobat\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80923375\java.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\elevation_service.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\msedge_pwa_launcher.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0\X86\MpCmdRun.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\msedge.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\pwahelper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_301\bin\javacpl.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\94.0.992.31\BHO\ie_to_edge_stub.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdateBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.102\GoogleUpdateSetup.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe			Jump to behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeGenuineSlimInstaller.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Common Files\Adobe\Acrobat\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe			Jump to behavior

Drops PE files

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File created: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe			Jump to dropped file
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File created: C:\Program Files (x86)\Java\jre1.8.0_301\bin\unpack200.exe			Jump to dropped file

Boot Survival:

Creates autostart registry keys with suspicious values (likely registry only malware)

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Barthiani5 C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.vbs			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Barthiani5 C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.vbs			Jump to behavior

Creates an autostart registry key

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Barthiani5			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Barthiani5			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Barthiani5			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Barthiani5			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: AfWu3i35ny.exe, 00000001.00000002.39989633676.0000000002280000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\SYSWOW64\MSVBVM60.DLL\SEMILEAFL.EXE\ELECIVESBSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEBARTHIANI5
Source: AfWu3i35ny.exe, 00000001.00000002.39989633676.0000000002280000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\AfWu3i35ny.exe TID: 4968

Thread sleep count: 697 > 30

Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_301\bin\unpack200.exe

Jump to dropped file

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Code function: 1_2_004379AD rdtsc

1_2_004379AD

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Window / User API: threadDelayed 697

Jump to behavior

Queries a list of all running drivers

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

System information queried: ModuleInformation

Jump to behavior

Enumerates the file system

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\Application Data\			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: vmicshutdown
Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: vmicvss
Source: AfWu3i35ny.exe, 00000001.00000002.39989633676.0000000002280000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: AfWu3i35ny.exe, 00000001.00000002.39989633676.0000000002280000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\syswow64\msvbvm60.dll\SEMILEAFL.exe\ELECIVESBSoftware\Microsoft\Windows\CurrentVersion\RunOnceBarthiani5
Source: AfWu3i35ny.exe, 00000001.00000002.39991088451.0000000004809000.00000004.00000001.sdmp	Binary or memory string: vmicheartbeat

Anti Debugging:

Hides threads from debuggers

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Thread information set: HideFromDebugger			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Code function: 1_2_004379AD rdtsc

1_2_004379AD

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226A3C8 mov eax, dword ptr fs:[00000030h]		1_2_0226A3C8
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02268012 mov eax, dword ptr fs:[00000030h]		1_2_02268012
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226B0FC mov eax, dword ptr fs:[00000030h]		1_2_0226B0FC
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_02269D8F mov eax, dword ptr fs:[00000030h]		1_2_02269D8F

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Code function: 1_2_02268D86 LdrInitializeThunk,

1_2_02268D86

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226C05A LoadLibraryA,RtlAddVectoredExceptionHandler,		1_2_0226C05A
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226C286 RtlAddVectoredExceptionHandler,		1_2_0226C286
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226C0F8 RtlAddVectoredExceptionHandler,		1_2_0226C0F8
Source: C:\Users\user\Desktop\AfWu3i35ny.exe	Code function: 1_2_0226C500 RtlAddVectoredExceptionHandler,		1_2_0226C500

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\AfWu3i35ny.exe

Process created: C:\Users\user\Desktop\AfWu3i35ny.exe 'C:\Users\user\Desktop\AfWu3i35ny.exe'

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: SciTE.exe.9.dr

Binary or memory string: GShift+Alt+KeypadPlusMinusDecimalDivideMultiplyLeftRightUpDownInsertEndEnterSpaceEscapeWinMenuPLAT_WINPLAT_WINNTPropertiesEmbeddedtoolbar.largeACCELSSciTESciTEWindowSciTEWindowContentlatin1latin2big5gbkshift_jiseuc-krcyrilliciso-8859-5iso8859-111250windows-1251translation.encodingSciTE_HOMESciTE_USERHOMEUSERPROFILEHHCTRL.OCXHtmlHelpWRich Text FormatShell_TrayWndButtonfull.screen.hides.menuEditcmd.exe /c

Source: AdobeARM.exe.9.dr

Binary or memory string: BExitMaximize&Click to activateShell_NotifyIcon failedShell_TrayWndTrayNotifyWnd

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: AfWu3i35ny.exe, 00000009.00000003.41140386940.000000001E360000.00000004.00000001.sdmp	Binary or memory string: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0\MsMpEng.exe
Source: AfWu3i35ny.exe, 00000009.00000003.41140386940.000000001E360000.00000004.00000001.sdmp	Binary or memory string: _LC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0\MsMpEng.exe
Source: AfWu3i35ny.exe, 00000009.00000003.41169302599.000000001E368000.00000004.00000001.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: AfWu3i35ny.exe, type: SAMPLE
Source: Yara match	File source: 9.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.40357172124.000000001E354000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.39596077023.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.39985785397.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.39988281368.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\AfWu3i35ny.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe, type: DROPPED

GuLoader behavior detected

Source: Initial file

Signature Results: GuLoader behavior

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: AfWu3i35ny.exe, type: SAMPLE
Source: Yara match	File source: 9.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.AfWu3i35ny.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.40357172124.000000001E354000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.39596077023.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.39985785397.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.39988281368.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\AfWu3i35ny.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ELECIVESB\SEMILEAFL.exe, type: DROPPED