Windows Analysis Report 201021.exe

AV Detection:

Multi AV Scanner detection for submitted file

Source: 201021.exe

ReversingLabs: Detection: 40%

Machine Learning detection for sample

Source: 201021.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 10.2.InstallUtil.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 10.2.InstallUtil.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 10.0.InstallUtil.exe.400000.11.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 10.0.InstallUtil.exe.400000.11.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 10.0.InstallUtil.exe.400000.1.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 10.0.InstallUtil.exe.400000.1.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.2.201021.exe.39bac82.3.unpack	Avira: Label: TR/Inject.vcoldi

Compliance:

Uses 32bit PE files

Source: 201021.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 142.250.203.100:443 -> 192.168.2.7:49746 version: TLS 1.0

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 201021.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Binary contains paths to debug symbols

Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: anagement.pdb source: WerFault.exe, 00000012.00000003.372347216.0000000005617000.00000004.00000001.sdmp
Source:	Binary string: System.ni.pdb% source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb" source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000012.00000003.354853328.0000000003143000.00000004.00000001.sdmp
Source:	Binary string: System.Runtime.Remoting.pdbqk source: WERC408.tmp.dmp.18.dr
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb{q6 source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000012.00000003.372439909.00000000055D6000.00000004.00000040.sdmp
Source:	Binary string: wbemcomn.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: NapiNSP.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: System.Windows.Forms.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000012.00000003.353326488.0000000003137000.00000004.00000001.sdmp
Source:	Binary string: System.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: nlaapi.pdbUl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb[y>!- source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: ml.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: clr.pdb source: WerFault.exe, 00000012.00000003.372500112.00000000055D0000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Windows.Forms.pdb" source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: ility.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdb" source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdbyq7 source: WerFault.exe, 00000012.00000003.372422684.0000000005618000.00000004.00000001.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: System.Configuration.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000012.00000003.353950302.0000000003149000.00000004.00000001.sdmp
Source:	Binary string: anagement.pdb" source: WerFault.exe, 00000012.00000003.372347216.0000000005617000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000012.00000003.372191782.00000000055D1000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000012.00000003.372422684.0000000005618000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.406134139.0000000007D10000.00000004.00020000.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: 201021.exe, 00000001.00000002.307784889.00000000063D0000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000000.338774279.0000000000882000.00000002.00020000.sdmp, InstallUtil.exe.1.dr
Source:	Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe
Source:	Binary string: mscorlib.pdbdb source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: System.Configuration.pdbHH source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Xml.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb+ source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: mscoree.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: DWrite.pdbml source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: Accessibility.pdb~y> source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: k0C:\Windows\mscorlib.pdb source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: System.Core.ni.pdb~y> source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdbkl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Runtime.Remoting.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdb source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: shlwapi.pdbk source: WerFault.exe, 00000012.00000003.372191782.00000000055D1000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdbl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: comctl32v582.pdb{x6 source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000012.00000003.372439909.00000000055D6000.00000004.00000040.sdmp
Source:	Binary string: CMemoryExecute.pdb" source: WerFault.exe, 00000012.00000003.372422684.0000000005618000.00000004.00000001.sdmp
Source:	Binary string: rasadhlp.pdbYl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: msvcr120_clr0400.i386.pdb% source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERC408.tmp.dmp.18.dr
Source:	Binary string: System.Configuration.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdb source: InstallUtil.exe, 0000000A.00000002.405748695.00000000073BB000.00000004.00000001.sdmp, WerFault.exe, 00000012.00000003.372422684.0000000005618000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: comctl32v582.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: DWrite.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000012.00000003.372439909.00000000055D6000.00000004.00000040.sdmp
Source:	Binary string: System.Drawing.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: System.Management.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000012.00000003.354853328.0000000003143000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WERC408.tmp.dmp.18.dr
Source:	Binary string: Accessibility.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS source: WERC408.tmp.dmp.18.dr
Source:	Binary string: InstallUtil.PDB source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: ml.ni.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Core.ni.pdbRSDSD source: WERC408.tmp.dmp.18.dr
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: Accessibility.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: rawing.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Management.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: pnrpnsp.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: mscoreei.pdbk source: WerFault.exe, 00000012.00000003.372191782.00000000055D1000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: System.Xml.ni.pdb~y> source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb% source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: InstallUtil.pdb source: 201021.exe, 00000001.00000002.307784889.00000000063D0000.00000004.00000001.sdmp, InstallUtil.exe, InstallUtil.exe.1.dr
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000012.00000003.372500112.00000000055D0000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: CMemoryExecute.pdb source: WerFault.exe, 00000012.00000003.372422684.0000000005618000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000012.00000003.372500112.00000000055D0000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdbT source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: nlaapi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: diasymreader.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb9lf source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: wmiutils.pdb3ll source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wmiutils.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: wbemprox.pdbgl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbT3 source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: System.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000012.00000003.353326488.0000000003137000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000012.00000003.372500112.00000000055D0000.00000004.00000040.sdmp
Source:	Binary string: WLDP.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERC408.tmp.dmp.18.dr
Source:	Binary string: clrjit.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdb~y> source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: System.Runtime.Remoting.pdb~y> source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdbOl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Drawing.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: fastprox.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wbemsvc.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: winrnr.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe
Source:	Binary string: System.Runtime.Remoting.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: System.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: ore.ni.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: ore.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000012.00000003.372500112.00000000055D0000.00000004.00000040.sdmp
Source:	Binary string: psapi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: WMINet_Utils.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: CMemoryExecute.pdbMZ source: WERC408.tmp.dmp.18.dr
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: dhcpcsvc.pdbSl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: rawing.pdb" source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Core.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000012.00000003.353950302.0000000003149000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: mscoreei.pdb source: WerFault.exe, 00000012.00000003.372191782.00000000055D1000.00000004.00000040.sdmp
Source:	Binary string: System.Drawing.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: combase.pdbk source: WerFault.exe, 00000012.00000003.372439909.00000000055D6000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: System.pdb4: source: WERC408.tmp.dmp.18.dr
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: b.pdb00CE6}IgQ source: InstallUtil.exe, 0000000A.00000000.339327398.0000000000FA0000.00000004.00000020.sdmp
Source:	Binary string: winnsi.pdbAl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb" source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: .pdb source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: untime.Remoting.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: comctl32.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wbemprox.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp

Spreading:

May infect USB drives

Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp	Binary or memory string: autorun.inf
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp	Binary or memory string: [autorun]
Source: InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp	Binary or memory string: [autorun]
Source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp	Binary or memory string: autorun.inf
Source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp	Binary or memory string: [autorun]

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,		15_2_00408441
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,		15_2_00407E0E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 16_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,		16_2_00406EC3

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]		10_2_0737FE8B
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]		10_2_081E15E0

Networking:

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 142.250.203.100:443 -> 192.168.2.7:49746 version: TLS 1.0

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Found strings which match to known social media urls

Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe, 0000000F.00000002.351623076.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe, 0000000F.00000002.351623076.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: vbc.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)

URLs found in memory or binary data

Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://acdn.adnxs.com/ast/ast.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://acdn.adnxs.com/dmp/async_usersync.html
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://acdn.adnxs.com/dmp/async_usersync.html?gdpr=1&gdpr_consent=BOi01ZPOi01ZPAcABBENB4-AAAAid7__f_
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://amplify-imp.outbrain.com/pixel?p=nlV1YHXXXKgnJTkmjxGkpD86h377hQIinq23IJiX9nqxEkupAtbFH4fSP0Iz
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://b1-use2.zemanta.com/bidder/win/outbrainrtb/c333bcb0-98dc-11e9-8919-320929a4a620/0.564833/3F66
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://b1t-use2.zemanta.com/t/imp/impression/FZV2QWU7KWGCXF6REQZNFCRJIZ4GXAXBRWOOIKPCGXHSIEOKHUJBTWL
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertECCSecureServerCA.crt0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSecureSiteECCCA-1.crt0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cdn.adnxs.com/v/s/169/trk.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cdn.taboola.com/TaboolaCookieSyncScript.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cm.adform.net/pixel?adform_pid=16&adform_pc=3011883223893104794
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/?name=euconsent&value=&expire=0&isFirstRequest=true
Source: vbc.exe, 0000000F.00000003.349336779.0000000000C6C000.00000004.00000001.sdmp	String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/name=euconsent&value=&expire=0&isFirstRequest=true0&twa=1&s
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/onetrust-logo.svg
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSAOrganizationValidationSecureServerCA.crl0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl.globalsign.com/root.crl0V
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl.pki.goog/GTSGIAG3.crl0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertSecureSiteECCCA-1.crl0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ev-server-g2.crl04
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/ssca-ecc-g1.crl0.
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g5.crl0/
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertSecureSiteECCCA-1.crl0L
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ev-server-g2.crl0K
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/ssca-ecc-g1.crl0L
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g5.crl0L
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://dis.criteo.com/dis/usersync.aspx?r=7&p=148&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fs
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://e1.emxdgt.com/cs?d=d1&uid=3011883223893104794
Source: InstallUtil.exe, 0000000A.00000003.303485054.0000000005C72000.00000004.00000001.sdmp	String found in binary or memory: http://en.wikipg
Source: InstallUtil.exe, 0000000A.00000003.304199848.0000000005CAE000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: vbc.exe, 0000000F.00000003.349148362.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: http://ib.adnxs.com/async_usersync_file
Source: vbc.exe, 0000000F.00000003.349148362.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: http://ib.adnxs.com/getuid?http://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IiIsIml1ZSI6Imh0dHA6Ly9pbWFnZXMyLnplbWFudGEuY29tL
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjAxMmRiZGQ2ZTMxY2I0MTYxNmZjOWNjNjExZDU3MzhiY2UwN
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjAxOGQyZTYxNTQ5NjE3M2VjYzlkYWMyMWExY2Q4ZDFlYTRmM
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjJkYTFhZDAwNDEyNzQ2M2E3MGUyMWVkZmIxNmUyZjQ2MjBkM
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjM1OWYyYmUyYWEzNmM5ZGIxOWNkODJhMjgxMTNiZjk2MDliN
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjU1YWFlM2E2Yzk0NjI5ZTJjNzIwNTg1NTAyOWJhYWYwZmIxM
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjU5Zjc4ZGRjN2Y0NThlYzE2YmNhY2E0Y2E2YmFkYzgwNTYyZ
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjVhZWEwOTA0MmYxYzJjMDRlMmU1NDg1YzZmNjY2NTU5N2E5N
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjVlOTU1MDFkNzMwNDkzY2MzOWM0MzkzNmI4MTUzMTlhYTQ2O
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6ImE2Y2FkYjk5YjFhZTM3OGRiYjNlYjY3YzUxMTk0YzRkM2ViZ
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6ImQ1Y2M3ZjUxNTk0ZjI1ZWI5NjQxNjllMjcxMDliYzA5MWY4N
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6ImQ3OGFmNTY2YzEzMzI1ZTIwNzU3Y2FhOTg3NTNjNGRmMzYwZ
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA61Ofl?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA7XCQ3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AABzUSt?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADsAOZ?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADsWyr?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADsZuW?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuMD0?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuTp7?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv842?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv9IZ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbPR?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbPR?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbce?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvhNP?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvhax?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvqEs?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvuGs?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvzqT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyuliQ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzjSw3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB16g6qc?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17milU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18T33l?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19x3nX?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xCDZ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xGDT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xMWp?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xaUu?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xssM?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xzm6?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yF6n?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yFoT?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yuvA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yxVU?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1kc8s?m=6&o=true&u=true&n=true&w=30&h=30
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB6Ma4a?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB7hjL?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBGjoVB?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBIbOGs?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBMVUFn?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBO5Geh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPRPvf?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBRUB0d?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBS0Ogx?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBSDdmG?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBTrj40?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVBUge?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVQ7lO?h=50&w=50&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVuaWG?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVuddh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBWoHwx?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBX2afX?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBih5H?m=6&o=true&u=true&n=true&w=30&h=30
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnYSFZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BByBEMv?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: 201021.exe, 00000001.00000003.270974975.0000000006ADB000.00000004.00000001.sdmp, 201021.exe, 00000001.00000003.298024945.0000000006AE1000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.comodoca.com09
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.digicert.com0:
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.digicert.com0B
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.digicert.com0E
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.digicert.com0F
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.digicert.com0M
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.digicert.com0R
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.msocsp.com0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.pki.goog/GTSGIAG30
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://ocsp2.globalsign.com/cloudsslsha2g30V
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://pagead2.googlesyndication.com/pagead/js/r20190624/r20190131/show_ads_impl.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0#
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0M
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://pki.goog/gsr2/GTSGIAG3.crt0)
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://pr-bh.ybp.yahoo.com/sync/msft/3011883223893104794?gdpr=1&euconsent=BOi01ZPOi01ZPAcABBENB4-AAA
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://pr-bh.ybp.yahoo.com/sync/msft/3011883223893104794?gdpr=1&gdpr_consent=BOi01ZPOi01ZPAcABBENB4-
Source: vbc.exe, 0000000F.00000003.349148362.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: http://s.amazon-adsystem.com/v3/pr?exlist=an&fv=1.0&a=cm&cm3ppd=1
Source: vbc.exe, 0000000F.00000003.349148362.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: http://s.amazon-adsystem.com/x/da2e6c890e6e3636
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://sb.scorecardresearch.com/beacon.js
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: 201021.exe, 00000001.00000002.299444027.0000000002941000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.400261913.0000000002B31000.00000004.00000001.sdmp, WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 00000012.00000003.365286808.0000000005B30000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://secure.globalsign.com/cacert/cloudsslsha2g3.crt06
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/2366737e/webcore/externalscripts/oneTrust/ski
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/5445db85/webcore/externalscripts/oneTrust/de-
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/3bf20fde-50425371/directi
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/f60532dd-3aac3bb8/directi
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/3bf20fde-2923b6c2/directio
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/3bf20fde-b532f4eb/directio
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-2923b6c2/directio
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-f8dd99d9/directio
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/44/c08e43.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/52/8adb60.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/81/58b810.gif
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/86/2042ed.woff
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/8c/865070.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/95/8bd8bf.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA61Ofl.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA7XCQ3.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AABzUSt.img?h=368&w=622
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADsAOZ.img?h=166&w=310
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADsWyr.img?h=75&w=100&
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADsZuW.img?h=166&w=310
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuMD0.img?h=333&w=311
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuTp7.img?h=333&w=311
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv842.img?h=250&w=300
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv9IZ.img?h=75&w=100&
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbPR.img?h=250&w=300
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbPR.img?h=75&w=100&
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbce.img?h=166&w=310
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvhNP.img?h=75&w=100&
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvhax.img?h=166&w=310
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvqEs.img?h=166&w=310
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvuGs.img?h=333&w=311
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvzqT.img?h=166&w=310
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyuliQ.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzjSw3.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16g6qc.img?h=27&w=27&
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17milU.img?h=16&w=16&
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18T33l.img?h=333&w=31
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19x3nX.img?h=166&w=31
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xCDZ.img?h=75&w=100
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xGDT.img?h=166&w=31
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xMWp.img?h=75&w=100
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xaUu.img?h=166&w=31
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xssM.img?h=75&w=100
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xzm6.img?h=250&w=30
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yF6n.img?h=333&w=31
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yFoT.img?h=75&w=100
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yuvA.img?h=250&w=30
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yxVU.img?h=166&w=31
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1kc8s.img?m=6&o=true&
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB6Ma4a.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB7hjL.img?h=16&w=16&m=
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBGjoVB.img?h=50&w=50&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBIbOGs.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBMVUFn.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBO5Geh.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPRPvf.img?h=50&w=50&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBRUB0d.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBS0Ogx.img?h=75&w=100&
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBSDdmG.img?h=50&w=50&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBTrj40.img?h=50&w=50&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVBUge.img?h=50&w=50&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVQ7lO.img?h=50&w=50&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuaWG.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuddh.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBWoHwx.img?h=27&w=27&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BByBEMv.img?h=16&w=16&m
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://static.chartbeat.com/js/chartbeat.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://t.wayfair.com/a/vendor_sync/user?vendor_id=1&uid=3011883223893104794&t=1
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://trc.taboola.com/p3p.xml
Source: Amcache.hve.18.dr	String found in binary or memory: http://upx.sf.net
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp	String found in binary or memory: http://whatismyipaddress.com/-
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: InstallUtil.exe, 0000000A.00000003.310947599.0000000005C7A000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: InstallUtil.exe, 0000000A.00000003.309171852.0000000005C72000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: InstallUtil.exe, 0000000A.00000003.313892692.0000000005C7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: InstallUtil.exe, 0000000A.00000003.313438755.0000000005C7A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersL
Source: InstallUtil.exe, 0000000A.00000003.313195886.0000000005C78000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: InstallUtil.exe, 0000000A.00000003.313892692.0000000005C7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF/V
Source: InstallUtil.exe, 0000000A.00000003.312452193.0000000005C7A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comFQU
Source: InstallUtil.exe, 0000000A.00000003.314544444.0000000005C7D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: InstallUtil.exe, 0000000A.00000003.314544444.0000000005C7D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: InstallUtil.exe, 0000000A.00000003.314544444.0000000005C7D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comd$V
Source: InstallUtil.exe, 0000000A.00000003.314544444.0000000005C7D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdfetXU
Source: InstallUtil.exe, 0000000A.00000000.335330228.0000000005C70000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comldv
Source: InstallUtil.exe, 0000000A.00000003.313195886.0000000005C78000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comn
Source: InstallUtil.exe, 0000000A.00000003.312452193.0000000005C7A000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000000.335330228.0000000005C70000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: InstallUtil.exe, 0000000A.00000003.313892692.0000000005C7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comony
Source: InstallUtil.exe, 0000000A.00000003.314544444.0000000005C7D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coms
Source: InstallUtil.exe, 0000000A.00000003.314904895.0000000005C7D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comsiefd
Source: InstallUtil.exe, 0000000A.00000003.312539841.0000000005C7A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comsivauUs
Source: InstallUtil.exe, 0000000A.00000003.314544444.0000000005C7D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comueed
Source: InstallUtil.exe, 0000000A.00000003.303791795.000000000117B000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: InstallUtil.exe, 0000000A.00000003.303791795.000000000117B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comj
Source: InstallUtil.exe, 0000000A.00000003.306333247.0000000005C81000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: InstallUtil.exe, 0000000A.00000003.306333247.0000000005C81000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnCP
Source: InstallUtil.exe, 0000000A.00000003.306365686.0000000005C73000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnht
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://www.googleadservices.com/pagead/p3p.xml
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: InstallUtil.exe, 0000000A.00000003.309507974.0000000005C77000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/$V
Source: InstallUtil.exe, 0000000A.00000003.309507974.0000000005C77000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Curs
Source: InstallUtil.exe, 0000000A.00000003.309507974.0000000005C77000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/FU
Source: InstallUtil.exe, 0000000A.00000003.309507974.0000000005C77000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Stan
Source: InstallUtil.exe, 0000000A.00000003.309507974.0000000005C77000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/a-e
Source: InstallUtil.exe, 0000000A.00000003.310696053.0000000005C7A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/d
Source: InstallUtil.exe, 0000000A.00000003.310947599.0000000005C7A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: InstallUtil.exe, 0000000A.00000003.309507974.0000000005C77000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s_tr
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://www.msn.com
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://www.msn.com/
Source: vbc.exe, 0000000F.00000003.348895291.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/consent/55a804
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/scripttemplate
Source: vbc.exe, vbc.exe, 00000010.00000002.341034426.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: InstallUtil.exe, 0000000A.00000003.303013093.0000000005CAE000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: InstallUtil.exe, 0000000A.00000003.303013093.0000000005CAE000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com.
Source: InstallUtil.exe, 0000000A.00000003.303013093.0000000005CAE000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com9
Source: InstallUtil.exe, 0000000A.00000003.303013093.0000000005CAE000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comdK
Source: InstallUtil.exe, 0000000A.00000003.302539187.000000000117B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.coml
Source: InstallUtil.exe, 0000000A.00000003.303013093.0000000005CAE000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comx
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: InstallUtil.exe, 0000000A.00000003.310696053.0000000005C7A000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com-g
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: InstallUtil.exe, 0000000A.00000000.333704966.0000000002B9B000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.400261913.0000000002B31000.00000004.00000001.sdmp	String found in binary or memory: http://www.site.com/logs.php
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: InstallUtil.exe, 0000000A.00000003.309171852.0000000005C72000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comw
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: InstallUtil.exe, 0000000A.00000000.346221635.0000000006F02000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=7162084889081;g
Source: vbc.exe, 0000000F.00000003.348895291.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=57232382215
Source: vbc.exe, 0000000F.00000003.348895291.0000000002A2E000.00000004.00000001.sdmp, vbc.exe, 0000000F.00000003.349336779.0000000000C6C000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=5657692
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5723238221569;gt
Source: vbc.exe, 0000000F.00000003.348895291.0000000002A2E000.00000004.00000001.sdmp, vbc.exe, 0000000F.00000003.348944353.0000000002A39000.00000004.00000001.sdmp, vbc.exe, 0000000F.00000002.352211892.0000000002A43000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5723238221569;gtm=
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://amp.azure.net/libs/amp/1.8.0/azuremediaplayer.min.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://api.taboola.com/1.2/json/taboola-usersync/user.sync?app.type=desktop&app.apikey=e60e3b54fc66
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC54c8a2b02c3446f48a60b41e8a5ff47
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC5bdddb231cf54f958a5b6e76e9d8eee
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC828bc1cde9f04b788c98b5423157734
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC9b2d2bc73c8a4a1d8dd5c3d69b6634a
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc13122162a9a46c3b4cbf05ffccde0f
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc71c68d7b8f049b6a6f3b669bd5d00c
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCee0d4d5fd4424c8390d703b105f82c3
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCfd484f9188564713bbc5d13d862ebbf
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://assets.adobedtm.com/launch-EN7b3d710ac67a4a1195648458258f97dd.min.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://contextual.media.net/
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://contextual.media.net/48/nrrV18753.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://contextual.media.net/__media__/js/util/nrrV9140.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://cvision.media.net/new/286x175/2/75/95/36/612b163a-ff7b-498a-bad2-3c52bbd2c504.jpg?v=9
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://cvision.media.net/new/286x175/2/79/227/59/931bcbc9-c308-445b-ac87-70a69b051455.jpg?v=9
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://cvision.media.net/new/286x175/2/89/162/29/8ee7a9a3-dec9-4d15-94e1-5c73b17d2de1.jpg?v=9
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://cvision.media.net/new/300x194/2/100/237/97/93b3dc40-172c-479f-bf5a-5d49e8538bf9.jpg?v=9
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://cvision.media.net/new/300x300/2/100/237/97/93b3dc40-172c-479f-bf5a-5d49e8538bf9.jpg?v=9
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://cvision.media.net/new/300x300/3/167/174/27/39ab3103-8560-4a55-bfc4-401f897cf6f2.jpg?v=9
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BBEB4CB72
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:300
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UaGrENHsxJlGDuGo1OIlI3K.woff
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UabrENHsxJlGDuGo1OIlLU94bt3.woff
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v19/KFOlCnqEu92Fr1MmEU9fBBc-.woff
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v19/KFOlCnqEu92Fr1MmSU5fBBc-.woff
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v19/KFOmCnqEu92Fr1Mu4mxM.woff
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9vAA.woff
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Me5g.woff
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7064439419818173&output=html&h=250&twa=
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/adview?ai=C4ZZc-r8UXcilEM6E-gaA-YLQCODD_YZVtLCoh4gJ8ui0tf
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/drt/si
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/r20190624/r20190131/zrt_lookup.html
Source: vbc.exe, 0000000F.00000003.350371868.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/r20190624/r20190131/zrt_lookup.htmlB4-AAAAid7__f__3_
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DnuZ
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnv6
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnwt
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DsDH
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmQ
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmV
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmZ
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FGwC
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n1yl
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n4cm
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJ7
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJa
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4nqTh
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4sQww?ver=37ff
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tD2S
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tG3O
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoW
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoY
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tKUA
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOD
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOM
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tQVa
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4u1kF
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ubMD
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqj5
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4zuiC
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWeTGO?ver=8c74&q=90&m=
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ce_sharpen%2Ch_311%2Cw_207%2Cc_fill%
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: vbc.exe, 0000000F.00000003.348895291.0000000002A2E000.00000004.00000001.sdmp, vbc.exe, 0000000F.00000003.348944353.0000000002A39000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1601453683&rver=6.0.5286.0&wp=MBI_SSL&wre
Source: vbc.exe, 0000000F.00000003.349148362.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1561640951&rver=7.0.6730.0&wp=l
Source: vbc.exe, 0000000F.00000003.348895291.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: vbc.exe, 0000000F.00000003.348895291.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: vbc.exe, 0000000F.00000003.348895291.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: vbc.exe, 0000000F.00000003.348895291.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: vbc.exe, 0000000F.00000003.349122141.0000000000C6D000.00000004.00000001.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorizeyy
Source: vbc.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/MeControl.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://mcdp-chidc2.outbrain.com/l?token=c21d6fc334f1b2ec2cf4d2cbc4199764_4535_1561640954843
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://mcdp-chidc2.outbrain.com/l?token=cadd7d1b12e34ff71b0237f3627e8ef3_4535_1561640955067
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://mcdp-chidc2.outbrain.com/l?token=e2c41a910c7be90243b349629cd840b2_4535_1561640955327
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meBoot.min.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meCore.min.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://mem.gfx.ms/meversion?partner=RetailStore2&market=en-us&uhf=1
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://mwf-service.akamaized.net/mwf/css/bundle/1.57.0/west-european/default/mwf-main.min.css
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://mwf-service.akamaized.net/mwf/js/bundle/1.57.0/mwf-auto-init-main.var.min.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://optanon.blob.core.windows.net/skins/4.1.0/default_flat_top_two_button_black/v2/css/optanon.c
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://optanon.blob.core.windows.net/skins/4.1.0/default_flat_top_two_button_black/v2/images/cookie
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://p.rfihub.com/cm?in=1&pub=345&userid=3011883223893104794
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-7064439419818173.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://pki.goog/repository/0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://pr-bh.ybp.yahoo.com/sync/msn/0D4108E9D28A6B29364F0561D37B6A29
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/vhs/api/videos/RE4sQBc
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://s.yimg.com/lo/api/res/1.2/BXjlWewXmZ47HeV5NPvUYA--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://secure.comodo.com/CPS0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://srtb.msn.com/auction?a=de-ch&b=9a5be529d6034927bda092231704a93b&c=MSN&d=http%3A%2F%2Fwww.msn
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://statics-marketingsites-neu-ms-com.akamaized.net/statics/override.css?c=7
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://sync.outbrain.com/cookie-sync?p=medianet&uid=2046425540973639000V10
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20190624/r20110914/abg_lite.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20190624/r20110914/client/m_js_controller.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20190624/r20110914/client/qs_click_protection.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://tpc.googlesyndication.com/pagead/js/r20190624/r20110914/client/window_focus.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://tpc.googlesyndication.com/simgad/1034445299425550758?w=300&h=300
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://widgets.outbrain.com/
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=GTM-N7S69J3&cid=892565928.1601478348
Source: 201021.exe, 00000001.00000002.299444027.0000000002941000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: 201021.exe, 00000001.00000002.299444027.0000000002941000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/
Source: vbc.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/application/x-msdownloadC:
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/css/main.v3.min.css
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/app-store-download.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome-logo.svg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_safari-behavior.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_throbber_fast.gif
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/big_pixel_phone.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_phone.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_tablet.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-chrome-logo.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-logo-one-color.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-description-white-blue-bg.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-fb.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-file-download.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-help.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-twitter.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-youtube.jpg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/folder-applications.svg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/google-play-download.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-beta.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-canary.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-dev.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-enterprise.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-bottom-left.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-middle.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-top-right.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_features.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_privacy.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_tools.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/laptop_desktop.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/icon-announcement.svg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/icon-file-download.svg
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/images/mac-ico.png
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/js/installer.min.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/static/js/main.v2.min.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: vbc.exe, 0000000F.00000003.349148362.0000000002A2E000.00000004.00000001.sdmp, bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.google.com/pagead/drt/ui
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-26908291-4
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-PZ6TRJB
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/autotrack/autotrack.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/ScrollMagic.min.js
Source: bhv8BC6.tmp.15.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/animation.gsap.min.js

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.google.com

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected HawkEye Keylogger

Source: Yara match	File source: 10.0.InstallUtil.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.408208.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.2b5b360.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39bac82.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.45fa72.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.45fa72.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c2a8f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39bac82.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c5fec2.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c08658.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c108a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c0a05d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.334047730.0000000002DCA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.400261913.0000000002B31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.341956541.0000000002DDA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.332247492.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.338660293.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.305894961.00000000039BA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.334072591.0000000002DDA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.341915829.0000000002DCA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 201021.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WerFault.exe PID: 2212, type: MEMORYSTR

Installs a global keyboard hook

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Windows user hook set: 0 keyboard low level C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe

Jump to behavior

Contains functionality to log keystrokes (.Net Source)

Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	.Net Code: HookKeyboard
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	.Net Code: HookKeyboard
Source: 10.0.InstallUtil.exe.400000.1.unpack, Form1.cs	.Net Code: HookKeyboard

Contains functionality for read data from the clipboard

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_0040D674 OpenClipboard,GetLastError,DeleteFileW,

15_2_0040D674

System Summary:

Malicious sample detected (through community Yara rule)

Source: 10.0.InstallUtil.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.InstallUtil.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.0.InstallUtil.exe.408208.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.InstallUtil.exe.408208.13.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.0.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.InstallUtil.exe.2b5b360.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.201021.exe.39bac82.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.201021.exe.39bac82.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.0.InstallUtil.exe.45fa72.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.InstallUtil.exe.45fa72.14.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.0.InstallUtil.exe.45fa72.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.InstallUtil.exe.45fa72.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.0.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 10.0.InstallUtil.exe.409c0d.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.InstallUtil.exe.409c0d.12.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.201021.exe.39c2a8f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.201021.exe.39c2a8f.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.201021.exe.39bac82.3.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.201021.exe.39bac82.3.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.201021.exe.3c5fec2.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.201021.exe.3c5fec2.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.201021.exe.3c08658.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.201021.exe.3c08658.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.201021.exe.39c108a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.201021.exe.39c108a.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.201021.exe.3c0a05d.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.201021.exe.3c0a05d.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.334047730.0000000002DCA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.400261913.0000000002B31000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.332247492.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000000.332247492.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.338660293.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000000.338660293.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.305894961.00000000039BA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.305894961.00000000039BA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.341915829.0000000002DCA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group

.NET source code contains very large array initializations

Source: 201021.exe, Ne5k/Wf23.cs	Large array initialization: .cctor: array initializer size 3834
Source: 201021.exe, Yn9/n8R.cs	Large array initialization: .cctor: array initializer size 4656

Uses 32bit PE files

Source: 201021.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 10.0.InstallUtil.exe.7ca0000.19.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.InstallUtil.exe.7ca0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.InstallUtil.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.0.InstallUtil.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.InstallUtil.exe.400000.11.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.0.InstallUtil.exe.408208.13.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.0.InstallUtil.exe.408208.13.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.InstallUtil.exe.408208.13.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.0.InstallUtil.exe.2b8d4c0.16.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.InstallUtil.exe.7ca0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.0.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.0.InstallUtil.exe.7d10000.20.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.InstallUtil.exe.2b5b360.5.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.InstallUtil.exe.2b5b360.5.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.201021.exe.39bac82.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.201021.exe.39bac82.3.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.201021.exe.39bac82.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.0.InstallUtil.exe.2b8d4c0.6.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.InstallUtil.exe.7d10000.10.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.InstallUtil.exe.7d10000.10.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.InstallUtil.exe.45fa72.14.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.0.InstallUtil.exe.45fa72.14.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.2.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.2.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.0.InstallUtil.exe.45fa72.4.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.0.InstallUtil.exe.45fa72.4.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.2.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.2.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.0.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.0.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.0.InstallUtil.exe.409c0d.12.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 10.0.InstallUtil.exe.409c0d.12.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.201021.exe.39c2a8f.4.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.201021.exe.39c2a8f.4.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.201021.exe.39c2a8f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.201021.exe.39bac82.3.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.201021.exe.39bac82.3.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.201021.exe.39bac82.3.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.201021.exe.3c5fec2.8.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.201021.exe.3c5fec2.8.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.201021.exe.3c5fec2.8.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.201021.exe.3c08658.7.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.201021.exe.3c08658.7.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.201021.exe.3c08658.7.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.201021.exe.39c108a.5.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.201021.exe.39c108a.5.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.201021.exe.39c108a.5.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.201021.exe.3c0a05d.6.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.201021.exe.3c0a05d.6.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.201021.exe.3c0a05d.6.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 10.2.InstallUtil.exe.2b7109c.6.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000A.00000002.406134139.0000000007D10000.00000004.00020000.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000A.00000000.334047730.0000000002DCA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.400261913.0000000002B31000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.337600996.0000000007D10000.00000004.00020000.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000A.00000000.337446969.0000000007CA0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000A.00000000.347217323.0000000007D10000.00000004.00020000.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000A.00000000.332247492.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0000000A.00000000.332247492.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.338660293.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 0000000A.00000000.338660293.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.305894961.00000000039BA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000001.00000002.305894961.00000000039BA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.347141160.0000000007CA0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000A.00000002.406066723.0000000007CA0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.341915829.0000000002DCA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research

One or more processes crash

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 1932

Detected potential crypto function

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_008820B0		10_2_008820B0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_02AFB29C		10_2_02AFB29C
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_02AFC310		10_2_02AFC310
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_02AFB290		10_2_02AFB290
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_02AFB1F2		10_2_02AFB1F2
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_02AF99D0		10_2_02AF99D0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_02AFDFD0		10_2_02AFDFD0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_0737B4E0		10_2_0737B4E0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_0737EEC8		10_2_0737EEC8
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_0737BDB0		10_2_0737BDB0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_0737B4D5		10_2_0737B4D5
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_0737B198		10_2_0737B198
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_07370006		10_2_07370006
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_07376FA0		10_2_07376FA0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_07376FE4		10_2_07376FE4
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_0737FCB8		10_2_0737FCB8
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_081E0040		10_2_081E0040
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00405CF6		15_2_00405CF6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00404419		15_2_00404419
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00404516		15_2_00404516
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00413538		15_2_00413538
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_004145A1		15_2_004145A1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_0040E639		15_2_0040E639
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_004337AF		15_2_004337AF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_004399B1		15_2_004399B1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_0043DAE7		15_2_0043DAE7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00403F85		15_2_00403F85
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00411F99		15_2_00411F99
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 16_2_00404DDB		16_2_00404DDB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 16_2_0040BD8A		16_2_0040BD8A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 16_2_00404E4C		16_2_00404E4C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 16_2_00404EBD		16_2_00404EBD
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 16_2_00404F4E		16_2_00404F4E

Found potential string decryption / allocating functions

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00413F8E appears 66 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00413E2D appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00442A90 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 004141D6 appears 88 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00411538 appears 35 times

Contains functionality to call native functions

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_081E0CB0 NtSetContextThread,		10_2_081E0CB0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_081E0A98 NtResumeThread,		10_2_081E0A98
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_081E0BF8 NtWriteVirtualMemory,		10_2_081E0BF8
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_081E0CAB NtSetContextThread,		10_2_081E0CAB
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_081E0BF3 NtWriteVirtualMemory,		10_2_081E0BF3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,		15_2_00408836

Sample file is different than original file name gathered from version info

Source: 201021.exe	Binary or memory string: OriginalFilename vs 201021.exe
Source: 201021.exe, 00000001.00000002.298194628.00000000003C2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamesis.exe" vs 201021.exe
Source: 201021.exe, 00000001.00000002.308492623.0000000006870000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameRunPe6.dll" vs 201021.exe
Source: 201021.exe, 00000001.00000002.304273312.0000000002F05000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamePhulli.exe0 vs 201021.exe
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCMemoryExecute.dll@ vs 201021.exe
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWebBrowserPassView.exeF vs 201021.exe
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemailpv.exe< vs 201021.exe
Source: 201021.exe, 00000001.00000002.305782929.0000000003948000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSHCore1.dll0 vs 201021.exe
Source: 201021.exe, 00000001.00000002.307784889.00000000063D0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameInstallUtil.exeT vs 201021.exe
Source: 201021.exe	Binary or memory string: OriginalFilenamesis.exe" vs 201021.exe

Sample is known by Antivirus

Source: 201021.exe

ReversingLabs: Detection: 40%

PE file has an executable .text section and no other executable section

Source: 201021.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\201021.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\201021.exe 'C:\Users\user\Desktop\201021.exe'
Source: C:\Users\user\Desktop\201021.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 1932
Source: C:\Users\user\Desktop\201021.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Queries a list of all open handles

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System information queried: HandleInformation

Jump to behavior

Creates files inside the user directory

Source: C:\Users\user\Desktop\201021.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\201021.exe.log

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\201021.exe

File created: C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@8/12@2/2

Contains functionality to check free disk space

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_00415F87 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,

15_2_00415F87

SQL strings found in memory and binary data

Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe, 0000000F.00000002.351623076.0000000000400000.00000040.00000001.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Contains functionality for error logging

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_00415AFD GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,

15_2_00415AFD

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\201021.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Contains functionality to enum processes or threads

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_00411196 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,free,Process32NextW,CloseHandle,

15_2_00411196

.NET source code contains long base64-encoded strings

Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Base64 encoded string: 'jwpdbTVcqJzxvfBDtW68q7oRfljM8b8abw7DEV5/tgiR5+6Av2KoKY3S9Gf8JxQe', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	Base64 encoded string: 'jwpdbTVcqJzxvfBDtW68q7oRfljM8b8abw7DEV5/tgiR5+6Av2KoKY3S9Gf8JxQe', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
Source: 10.0.InstallUtil.exe.400000.1.unpack, Form1.cs	Base64 encoded string: 'jwpdbTVcqJzxvfBDtW68q7oRfljM8b8abw7DEV5/tgiR5+6Av2KoKY3S9Gf8JxQe', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6672

Contains functionality to load and extract PE file embedded resources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_00411EF8 FindResourceW,SizeofResource,LoadResource,LockResource,

15_2_00411EF8

.NET source code contains calls to encryption/decryption functions

Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'

Reads the hosts file

Source: C:\Users\user\Desktop\201021.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\201021.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file has a big code size

Source: 201021.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Checks if Microsoft Office is installed

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Jump to behavior

Submission file is bigger than most known malware samples

Source: 201021.exe

Static file information: File size 1327104 > 1048576

PE file contains a COM descriptor data directory

Source: 201021.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

PE file has a big raw section

Source: 201021.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x143600

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 201021.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Binary contains paths to debug symbols

Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: anagement.pdb source: WerFault.exe, 00000012.00000003.372347216.0000000005617000.00000004.00000001.sdmp
Source:	Binary string: System.ni.pdb% source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb" source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000012.00000003.354853328.0000000003143000.00000004.00000001.sdmp
Source:	Binary string: System.Runtime.Remoting.pdbqk source: WERC408.tmp.dmp.18.dr
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb{q6 source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000012.00000003.372439909.00000000055D6000.00000004.00000040.sdmp
Source:	Binary string: wbemcomn.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: NapiNSP.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: System.Windows.Forms.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000012.00000003.353326488.0000000003137000.00000004.00000001.sdmp
Source:	Binary string: System.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: nlaapi.pdbUl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb[y>!- source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: ml.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: clr.pdb source: WerFault.exe, 00000012.00000003.372500112.00000000055D0000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Windows.Forms.pdb" source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: ility.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdb" source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdbyq7 source: WerFault.exe, 00000012.00000003.372422684.0000000005618000.00000004.00000001.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: System.Configuration.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000012.00000003.353950302.0000000003149000.00000004.00000001.sdmp
Source:	Binary string: anagement.pdb" source: WerFault.exe, 00000012.00000003.372347216.0000000005617000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000012.00000003.372191782.00000000055D1000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000012.00000003.372422684.0000000005618000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.406134139.0000000007D10000.00000004.00020000.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: 201021.exe, 00000001.00000002.307784889.00000000063D0000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000000.338774279.0000000000882000.00000002.00020000.sdmp, InstallUtil.exe.1.dr
Source:	Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe
Source:	Binary string: mscorlib.pdbdb source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: System.Configuration.pdbHH source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Xml.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb+ source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: mscoree.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: DWrite.pdbml source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: Accessibility.pdb~y> source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: k0C:\Windows\mscorlib.pdb source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: System.Core.ni.pdb~y> source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdbkl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Runtime.Remoting.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdb source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: shlwapi.pdbk source: WerFault.exe, 00000012.00000003.372191782.00000000055D1000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdbl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: comctl32v582.pdb{x6 source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000012.00000003.372439909.00000000055D6000.00000004.00000040.sdmp
Source:	Binary string: CMemoryExecute.pdb" source: WerFault.exe, 00000012.00000003.372422684.0000000005618000.00000004.00000001.sdmp
Source:	Binary string: rasadhlp.pdbYl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: msvcr120_clr0400.i386.pdb% source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERC408.tmp.dmp.18.dr
Source:	Binary string: System.Configuration.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdb source: InstallUtil.exe, 0000000A.00000002.405748695.00000000073BB000.00000004.00000001.sdmp, WerFault.exe, 00000012.00000003.372422684.0000000005618000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: comctl32v582.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: DWrite.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000012.00000003.372439909.00000000055D6000.00000004.00000040.sdmp
Source:	Binary string: System.Drawing.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: System.Management.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000012.00000003.354853328.0000000003143000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WERC408.tmp.dmp.18.dr
Source:	Binary string: Accessibility.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS source: WERC408.tmp.dmp.18.dr
Source:	Binary string: InstallUtil.PDB source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: ml.ni.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Core.ni.pdbRSDSD source: WERC408.tmp.dmp.18.dr
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: Accessibility.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: rawing.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Management.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: pnrpnsp.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: mscoreei.pdbk source: WerFault.exe, 00000012.00000003.372191782.00000000055D1000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: System.Xml.ni.pdb~y> source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb% source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: InstallUtil.pdb source: 201021.exe, 00000001.00000002.307784889.00000000063D0000.00000004.00000001.sdmp, InstallUtil.exe, InstallUtil.exe.1.dr
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000012.00000003.372500112.00000000055D0000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: CMemoryExecute.pdb source: WerFault.exe, 00000012.00000003.372422684.0000000005618000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000012.00000003.372500112.00000000055D0000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdbT source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: nlaapi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: diasymreader.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb9lf source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: wmiutils.pdb3ll source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wmiutils.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: wbemprox.pdbgl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbT3 source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: System.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000012.00000003.353326488.0000000003137000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000012.00000003.372500112.00000000055D0000.00000004.00000040.sdmp
Source:	Binary string: WLDP.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERC408.tmp.dmp.18.dr
Source:	Binary string: clrjit.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdb~y> source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: System.Runtime.Remoting.pdb~y> source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdbOl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Drawing.pdbXy>" source: WerFault.exe, 00000012.00000003.372162520.00000000055DD000.00000004.00000040.sdmp
Source:	Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: fastprox.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wbemsvc.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: winrnr.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, vbc.exe
Source:	Binary string: System.Runtime.Remoting.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: System.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: ore.ni.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: ore.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000012.00000003.372500112.00000000055D0000.00000004.00000040.sdmp
Source:	Binary string: psapi.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: WMINet_Utils.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: CMemoryExecute.pdbMZ source: WERC408.tmp.dmp.18.dr
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: dhcpcsvc.pdbSl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: rawing.pdb" source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: System.Core.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000012.00000003.353950302.0000000003149000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000012.00000003.372300822.0000000005601000.00000004.00000001.sdmp
Source:	Binary string: mscoreei.pdb source: WerFault.exe, 00000012.00000003.372191782.00000000055D1000.00000004.00000040.sdmp
Source:	Binary string: System.Drawing.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: combase.pdbk source: WerFault.exe, 00000012.00000003.372439909.00000000055D6000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdb source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: System.pdb4: source: WERC408.tmp.dmp.18.dr
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp
Source:	Binary string: b.pdb00CE6}IgQ source: InstallUtil.exe, 0000000A.00000000.339327398.0000000000FA0000.00000004.00000020.sdmp
Source:	Binary string: winnsi.pdbAl source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000012.00000003.372220827.00000000055D9000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb" source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: .pdb source: InstallUtil.exe, 0000000A.00000002.408810400.00000000084AA000.00000004.00000010.sdmp
Source:	Binary string: untime.Remoting.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp
Source:	Binary string: comctl32.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: wbemprox.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb source: WerFault.exe, 00000012.00000003.372285167.00000000055EA000.00000004.00000001.sdmp, WERC408.tmp.dmp.18.dr
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000012.00000003.372263564.00000000055E4000.00000004.00000040.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.InstallUtil.exe.400000.1.unpack, Form1.cs	.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.InstallUtil.exe.400000.1.unpack, Form1.cs	.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.InstallUtil.exe.400000.1.unpack, Form1.cs	.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.InstallUtil.exe.400000.1.unpack, Form1.cs	.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\201021.exe	Code function: 1_2_003C4F7C push esi; iretd		1_2_003C4F7B
Source: C:\Users\user\Desktop\201021.exe	Code function: 1_2_003C4F66 push esi; iretd		1_2_003C4F7B
Source: C:\Users\user\Desktop\201021.exe	Code function: 1_2_003C4163 push ds; iretd		1_2_003C41F4
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 10_2_02AFE672 push esp; ret		10_2_02AFE679
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00442871 push ecx; ret		15_2_00442881
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00442A90 push eax; ret		15_2_00442AA4
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00442A90 push eax; ret		15_2_00442ACC
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00446E54 push eax; ret		15_2_00446E61
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 16_2_00411879 push ecx; ret		16_2_00411889
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 16_2_004118A0 push eax; ret		16_2_004118B4
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 16_2_004118A0 push eax; ret		16_2_004118DC

Contains functionality to dynamically determine API calls

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_004422C7 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

15_2_004422C7

.NET source code contains many randomly named methods

Source: 201021.exe, s0E4/y4L2.cs

High entropy of concatenated method names: '.ctor', 'Pq0n', 'Dg7w', 'Ai6k', 'Ga43', 'Ci9w', 'p3ET', 'Jb03', 'n1W2', 'Xf2y'

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\201021.exe

File created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Changes the view of files in windows explorer (hidden files and folders)

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\201021.exe

File opened: C:\Users\user\Desktop\201021.exe\:Zone.Identifier read attributes | delete

Jump to behavior

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_00441975 memset,wcscpy,memset,wcscpy,wcscat,wcscpy,wcscat,wcscpy,wcscat,GetModuleHandleW,LoadLibraryExW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

15_2_00441975

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\201021.exe TID: 6568	Thread sleep time: -1844674407370954s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe TID: 6652	Thread sleep count: 165 > 30			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe TID: 2284	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe TID: 2832	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 6764	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 7024	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 7028	Thread sleep time: -140000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 7036	Thread sleep time: -300000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 6168	Thread sleep time: -180000s >= -30000s			Jump to behavior

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,

15_2_00408836

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\201021.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 180000			Jump to behavior

Queries a list of all running processes

Source: C:\Users\user\Desktop\201021.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to query system information

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_004161B0 memset,GetSystemInfo,

15_2_004161B0

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,		15_2_00408441
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 15_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,		15_2_00407E0E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 16_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,		16_2_00406EC3

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\201021.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 140000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 180000			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.18.dr	Binary or memory string: VMware
Source: Amcache.hve.18.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: WerFault.exe, 00000012.00000002.397598612.0000000004E70000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWx
Source: Amcache.hve.18.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual USB Mouse
Source: 201021.exe	Binary or memory string: IHGFSD
Source: Amcache.hve.18.dr	Binary or memory string: VMware, Inc.
Source: bhv8BC6.tmp.15.dr	Binary or memory string: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211020T175915Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ab01de4f31394836bbe449e99249472f&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1218113&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1218113&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.18.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.18.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.18.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.18.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 00000012.00000002.397927801.0000000005011000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.18.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.18.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.18.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.18.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.18.dr	Binary or memory string: VMware-42 35 44 6e 75 85 11 47-bd a2 bb ed 21 43 9f 89
Source: InstallUtil.exe, 0000000A.00000000.339215590.0000000000F24000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.18.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,

15_2_00408836

Contains functionality to dynamically determine API calls

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_004422C7 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

15_2_004422C7

Enables debug privileges

Source: C:\Users\user\Desktop\201021.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process token adjusted: Debug			Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process queried: DebugPort			Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\201021.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\201021.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 402000			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 482000			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 486000			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: B9A008			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 443000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 44F000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 452000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 412000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 416000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 418000			Jump to behavior

.NET source code references suspicious native API functions

Source: 10.2.InstallUtil.exe.400000.0.unpack, Form1.cs	Reference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 10.2.InstallUtil.exe.400000.0.unpack, RunPE.cs	Reference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
Source: 10.0.InstallUtil.exe.400000.11.unpack, Form1.cs	Reference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 10.0.InstallUtil.exe.400000.11.unpack, RunPE.cs	Reference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
Source: 10.0.InstallUtil.exe.400000.1.unpack, Form1.cs	Reference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 10.0.InstallUtil.exe.400000.1.unpack, RunPE.cs	Reference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\201021.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5A			Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\201021.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: InstallUtil.exe, 0000000A.00000000.333452383.0000000001550000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: InstallUtil.exe, 0000000A.00000000.333452383.0000000001550000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: InstallUtil.exe, 0000000A.00000000.333452383.0000000001550000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: InstallUtil.exe, 0000000A.00000000.333452383.0000000001550000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\201021.exe	Queries volume information: C:\Users\user\Desktop\201021.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\201021.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\InstallUtil.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\201021.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query local / system time

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_0041604B GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy,

15_2_0041604B

Contains functionality to query windows version

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 15_2_00407674 GetVersionExW,

15_2_00407674

Contains functionality to query the account / user name

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 16_2_0040724C memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,

16_2_0040724C

Lowering of HIPS / PFW / Operating System Security Settings:

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.18.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: InstallUtil.exe, 0000000A.00000000.339327398.0000000000FA0000.00000004.00000020.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: InstallUtil.exe, 0000000A.00000000.339327398.0000000000FA0000.00000004.00000020.sdmp	Binary or memory string: Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected MailPassView

Source: Yara match	File source: 10.0.InstallUtil.exe.3b39930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.3b39930.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c5fec2.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.45fa72.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.408208.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.45fa72.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.3b39930.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.3b39930.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.45fa72.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.3b39930.18.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39bac82.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.3b39930.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.45fa72.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.45fa72.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c2a8f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39bac82.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c5fec2.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c08658.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c108a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c0a05d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.334186783.0000000003B39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.344058983.0000000003B39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.332247492.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.401344855.0000000003B39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.338660293.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.305894961.00000000039BA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.341034426.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 201021.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 7128, type: MEMORYSTR

Yara detected HawkEye Keylogger

Source: Yara match	File source: 10.0.InstallUtil.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.408208.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.2b5b360.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39bac82.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.45fa72.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.45fa72.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c2a8f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39bac82.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c5fec2.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c08658.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c108a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c0a05d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.334047730.0000000002DCA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.400261913.0000000002B31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.341956541.0000000002DDA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.332247492.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.338660293.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.305894961.00000000039BA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.334072591.0000000002DDA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.341915829.0000000002DCA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 201021.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WerFault.exe PID: 2212, type: MEMORYSTR

Tries to steal Mail credentials (via file registry)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, PopPassword		16_2_00402D9A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, SMTPPassword		16_2_00402D9A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: ESMTPPassword		16_2_004033D7

Yara detected WebBrowserPassView password recovery tool

Source: Yara match	File source: 10.0.InstallUtil.exe.3b39930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.409c0d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.3b51b50.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.408208.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.3b39930.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.3b51b50.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c0a05d.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c2a8f.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.3b51b50.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.3b39930.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.3b51b50.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39bac82.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.3b51b50.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.3b51b50.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c2a8f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39bac82.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c5fec2.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c08658.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c108a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c0a05d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.334186783.0000000003B39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.344058983.0000000003B39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.332247492.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.401344855.0000000003B39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.338660293.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.305894961.00000000039BA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.351623076.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 201021.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6672, type: MEMORYSTR

Tries to steal Mail credentials (via file access)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail			Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Dynamic Salt			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Remote Access Functionality:

Yara detected HawkEye Keylogger

Source: Yara match	File source: 10.0.InstallUtil.exe.400000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.408208.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.2b5b360.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39bac82.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.45fa72.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.45fa72.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.InstallUtil.exe.409c0d.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c2a8f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39bac82.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c5fec2.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c08658.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.39c108a.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.201021.exe.3c0a05d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.334047730.0000000002DCA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.400261913.0000000002B31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.341956541.0000000002DDA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.332247492.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.338660293.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.305894961.00000000039BA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.334072591.0000000002DDA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.341915829.0000000002DCA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 201021.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WerFault.exe PID: 2212, type: MEMORYSTR

Detected HawkEye Rat

Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp	String found in binary or memory: \pidloc.txt!HawkEyeKeylogger
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp	String found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger | Execution Confirmed |
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp	String found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger | Stealer Records |
Source: 201021.exe, 00000001.00000002.306231571.0000000003B80000.00000004.00000001.sdmp	String found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
Source: InstallUtil.exe, 0000000A.00000000.334047730.0000000002DCA000.00000004.00000001.sdmp	String found in binary or memory: m&HawkEye_Keylogger_Execution_Confirmed_
Source: InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: \pidloc.txt!HawkEyeKeylogger
Source: InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger | Execution Confirmed |
Source: InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger | Stealer Records |
Source: InstallUtil.exe, 0000000A.00000002.398718518.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
Source: InstallUtil.exe, 0000000A.00000000.333704966.0000000002B9B000.00000004.00000001.sdmp	String found in binary or memory: HawkEyeKeylogger
Source: InstallUtil.exe, 0000000A.00000002.400306360.0000000002B6E000.00000004.00000001.sdmp	String found in binary or memory: m"HawkEye_Keylogger_Stealer_Records_
Source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp	String found in binary or memory: \pidloc.txt!HawkEyeKeylogger
Source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp	String found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger | Execution Confirmed |
Source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp	String found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger | Stealer Records |
Source: WerFault.exe, 00000012.00000003.369583710.0000000005830000.00000004.00000001.sdmp	String found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_