Loading ...

Play interactive tourEdit tour

Windows Analysis Report Halkbank.exe

Overview

General Information

Sample Name:Halkbank.exe
Analysis ID:528764
MD5:4b230a305cc22a04446b397310070d56
SHA1:208524b096c579b89579febff0b40f752b4e7db4
SHA256:a22ca2c5d6086e8c6703deb2e345efc08627e7063c447d60babe6edb17503856
Tags:AgentTeslaexegeoHalkbankTUR
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Writes to foreign memory regions
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Allocates memory in foreign processes
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
Checks if the current process is being debugged
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • Halkbank.exe (PID: 6272 cmdline: "C:\Users\user\Desktop\Halkbank.exe" MD5: 4B230A305CC22A04446B397310070D56)
    • RegSvcs.exe (PID: 5972 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)
      • WerFault.exe (PID: 4232 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 1476 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "info@devmetsan.com.tr", "Password": "Murat2019*", "Host": "mail.devmetsan.com.tr"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000005.00000000.493010505.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000005.00000000.493010505.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
        00000001.00000002.289972605.0000000002DA1000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          00000005.00000002.534823642.0000000002E21000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 28 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.Halkbank.exe.3e39bb8.3.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.Halkbank.exe.3e39bb8.3.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                5.0.RegSvcs.exe.400000.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  5.0.RegSvcs.exe.400000.4.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    1.2.Halkbank.exe.3e04198.2.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 20 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper ArgumentsShow sources
                      Source: Process startedAuthor: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: "C:\Users\user\Desktop\Halkbank.exe" , ParentImage: C:\Users\user\Desktop\Halkbank.exe, ParentProcessId: 6272, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 5972
                      Sigma detected: Possible Applocker BypassShow sources
                      Source: Process startedAuthor: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: "C:\Users\user\Desktop\Halkbank.exe" , ParentImage: C:\Users\user\Desktop\Halkbank.exe, ParentProcessId: 6272, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 5972

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 5.0.RegSvcs.exe.400000.4.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "info@devmetsan.com.tr", "Password": "Murat2019*", "Host": "mail.devmetsan.com.tr"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Halkbank.exeVirustotal: Detection: 19%Perma Link
                      Source: 5.0.RegSvcs.exe.400000.4.unpackAvira: Label: TR/Spy.Gen8
                      Source: 5.0.RegSvcs.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 5.0.RegSvcs.exe.400000.5.unpackAvira: Label: TR/Spy.Gen8
                      Source: 5.0.RegSvcs.exe.400000.6.unpackAvira: Label: TR/Spy.Gen8
                      Source: 5.0.RegSvcs.exe.400000.2.unpackAvira: Label: TR/Spy.Gen8
                      Source: 5.0.RegSvcs.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 5.2.RegSvcs.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 5.0.RegSvcs.exe.400000.3.unpackAvira: Label: TR/Spy.Gen8
                      Source: Halkbank.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Halkbank.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: rsaenh.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: anagement.pdb source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.ni.pdb% source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: System.ni.pdb" source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000018.00000003.501131452.0000000004FE8000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.501577620.0000000004FE9000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.PDB source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: wbemcomn.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000018.00000003.515947307.0000000005527000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516030444.0000000005527000.00000004.00000040.sdmp
                      Source: Binary string: System.pdb' source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: System.Management.pdbHk source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: .pdb&&=8 source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: ore.ni.pdb" source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: RegSvcs.pdb source: RegSvcs.exe, 00000005.00000000.492318602.000000000602D000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.536059728.000000000602D000.00000004.00000001.sdmp
                      Source: Binary string: .ni.pdb source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: clr.pdb source: WerFault.exe, 00000018.00000003.516018795.0000000005520000.00000004.00000040.sdmp
                      Source: Binary string: cryptsp.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: advapi32.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: oC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdbr source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: wbemcomn.pdb& source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: vaultcli.pdb8 source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Configuration.ni.pdb" source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: CLBCatQ.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Configuration.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: System.pdb"" source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000018.00000003.501258894.0000000003025000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.501634756.0000000003025000.00000004.00000001.sdmp
                      Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbu source: RegSvcs.exe, 00000005.00000002.534261296.0000000001125000.00000004.00000020.sdmp, RegSvcs.exe, 00000005.00000000.493739799.0000000001125000.00000004.00000020.sdmp
                      Source: Binary string: \??\C:\Windows\RegSvcs.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: sxs.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Xml.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: indows.Forms.pdb source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: RegSvcs.PDB source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: mscoree.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: ws2_32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: mscorlib.pdb@ source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: shlwapi.pdbk source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: wbemdisp.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: RegSvcs.pdbegSvcs.pdbpdbvcs.pdbv4.0.30319\RegSvcs.pdb3062332-1002 source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: RegSvcs.pdb, source: RegSvcs.exe, 00000005.00000000.492318602.000000000602D000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.536059728.000000000602D000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\RegSvcs.pdb6 source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 00000018.00000003.515947307.0000000005527000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516030444.0000000005527000.00000004.00000040.sdmp
                      Source: Binary string: powrprof.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: msvcr120_clr0400.i386.pdb% source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: mscorlib.ni.pdbRSDS source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: System.Configuration.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: \??\C:\Windows\System.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: ole32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: mscorlib.ni.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: mscorlib.pdb source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Management.pdb source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: combase.pdb source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: \??\C:\Windows\exe\RegSvcs.pdb= source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: RegSvcs.exe, 00000005.00000002.534261296.0000000001125000.00000004.00000020.sdmp, RegSvcs.exe, 00000005.00000000.493739799.0000000001125000.00000004.00000020.sdmp
                      Source: Binary string: wbemprox.pdbb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Configuration.ni.pdbRSDSO* source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: System.Configuration.pdbH source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: CustomMarshalers.pdbCA source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: System.Xml.ni.pdbRSDS source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: RegSvcs.pdbr source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: WinTypes.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Core.ni.pdbRSDSD source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: \??\C:\Windows\symbols\exe\RegSvcs.pdbk source: RegSvcs.exe, 00000005.00000000.490961404.00000000011CB000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.534391615.00000000011CB000.00000004.00000001.sdmp
                      Source: Binary string: diasymreader.pdb_ source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.Management.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: mscorlib.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: mscoreei.pdbk source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: shcore.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Core.ni.pdb% source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: C:\Windows\RegSvcs.pdbpdbvcs.pdb.[ source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: vaultcli.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000018.00000003.516018795.0000000005520000.00000004.00000040.sdmp
                      Source: Binary string: fltLib.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Core.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: shell32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000018.00000003.516018795.0000000005520000.00000004.00000040.sdmp
                      Source: Binary string: \??\C:\Windows\symbols\exe\RegSvcs.pdb source: RegSvcs.exe, 00000005.00000000.490961404.00000000011CB000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.534391615.00000000011CB000.00000004.00000001.sdmp
                      Source: Binary string: o0C:\Windows\RegSvcs.pdb source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: wimm32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Xml.ni.pdbT source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: diasymreader.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: wmiutils.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Xml.pdb{{(9 source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: .pdb source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\symbols\dll\System.pdbd source: RegSvcs.exe, 00000005.00000000.490961404.00000000011CB000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.534391615.00000000011CB000.00000004.00000001.sdmp
                      Source: Binary string: profapi.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.ni.pdbT3%l source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: symbols\exe\RegSvcs.pdbzX source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000018.00000003.516018795.0000000005520000.00000004.00000040.sdmp
                      Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: sechost.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: System.ni.pdbRSDS source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: ws2_32.pdbV source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: clrjit.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: fastprox.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: wbemsvc.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: msctf.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: version.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Xml.pdb source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: CustomMarshalers.pdb source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: ore.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.pdb source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: System.Windows.Forms.pdb source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000018.00000003.516018795.0000000005520000.00000004.00000040.sdmp
                      Source: Binary string: psapi.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: WMINet_Utils.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\dll\System.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: System.Core.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: mscoreei.pdb source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000018.00000003.501258894.0000000003025000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.501634756.0000000003025000.00000004.00000001.sdmp
                      Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.PDB source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: System.Core.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: combase.pdbk source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: \??\C:\Windows\exe\RegSvcs.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: wuser32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: Microsoft.VisualBasic.pdb" source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: wbemprox.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Xml.ni.pdb" source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: RegSvcs.exe, 00000005.00000002.534823642.0000000002E21000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.491312153.0000000002E21000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: RegSvcs.exe, 00000005.00000000.491312153.0000000002E21000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: RegSvcs.exe, 00000005.00000000.491312153.0000000002E21000.00000004.00000001.sdmpString found in binary or memory: http://OGxUTf.com
                      Source: WerFault.exe, 00000018.00000002.532293810.0000000004EB0000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
                      Source: WerFault.exe, 00000018.00000003.513211711.00000000059D0000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
                      Source: Amcache.hve.24.drString found in binary or memory: http://upx.sf.net
                      Source: RegSvcs.exe, 00000005.00000000.491450693.0000000002ED1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%
                      Source: RegSvcs.exe, 00000005.00000000.491312153.0000000002E21000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: Halkbank.exe, 00000001.00000002.290543372.0000000003DA9000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.493010505.0000000000402000.00000040.00000001.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: RegSvcs.exe, 00000005.00000002.534823642.0000000002E21000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.491312153.0000000002E21000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      Spam, unwanted Advertisements and Ransom Demands:

                      barindex
                      Modifies the hosts fileShow sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 5.0.RegSvcs.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007bC8CB4320u002d469Eu002d4CE6u002dB4D2u002dAB375F7FC036u007d/u0037A240B66u002d27E2u002d4E75u002d8780u002d28B311BBCB88.csLarge array initialization: .cctor: array initializer size 11838
                      Source: 5.0.RegSvcs.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007bC8CB4320u002d469Eu002d4CE6u002dB4D2u002dAB375F7FC036u007d/u0037A240B66u002d27E2u002d4E75u002d8780u002d28B311BBCB88.csLarge array initialization: .cctor: array initializer size 11838
                      Source: 5.0.RegSvcs.exe.400000.5.unpack, u003cPrivateImplementationDetailsu003eu007bC8CB4320u002d469Eu002d4CE6u002dB4D2u002dAB375F7FC036u007d/u0037A240B66u002d27E2u002d4E75u002d8780u002d28B311BBCB88.csLarge array initialization: .cctor: array initializer size 11838
                      Source: 5.0.RegSvcs.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007bC8CB4320u002d469Eu002d4CE6u002dB4D2u002dAB375F7FC036u007d/u0037A240B66u002d27E2u002d4E75u002d8780u002d28B311BBCB88.csLarge array initialization: .cctor: array initializer size 11838
                      Source: 5.0.RegSvcs.exe.400000.2.unpack, u003cPrivateImplementationDetailsu003eu007bC8CB4320u002d469Eu002d4CE6u002dB4D2u002dAB375F7FC036u007d/u0037A240B66u002d27E2u002d4E75u002d8780u002d28B311BBCB88.csLarge array initialization: .cctor: array initializer size 11838
                      Source: Halkbank.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 1476
                      Source: C:\Users\user\Desktop\Halkbank.exeCode function: 1_2_009FA2A9
                      Source: C:\Users\user\Desktop\Halkbank.exeCode function: 1_2_06100F28
                      Source: C:\Users\user\Desktop\Halkbank.exeCode function: 1_2_06100040
                      Source: C:\Users\user\Desktop\Halkbank.exeCode function: 1_2_061046FD
                      Source: C:\Users\user\Desktop\Halkbank.exeCode function: 1_2_061047F0
                      Source: C:\Users\user\Desktop\Halkbank.exeCode function: 1_2_061047E1
                      Source: C:\Users\user\Desktop\Halkbank.exeCode function: 1_2_009FA035
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F10040
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F18A48
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F12A29
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F18828
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F1B6E8
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F19878
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F2C2F0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F21FE2
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F2AB70
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F22768
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F27CB6
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F27880
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F279A7
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F2795F
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F27A09
                      Source: Halkbank.exe, 00000001.00000002.289355845.0000000000A8A000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameSafeBSTRHand.exeJ vs Halkbank.exe
                      Source: Halkbank.exe, 00000001.00000002.290543372.0000000003DA9000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameIndvGslqFtFYfKpHTgcTQzFewbwOcpef.exe4 vs Halkbank.exe
                      Source: Halkbank.exe, 00000001.00000002.290543372.0000000003DA9000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUI.dll@ vs Halkbank.exe
                      Source: Halkbank.exe, 00000001.00000002.292657318.0000000006080000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameUI.dll@ vs Halkbank.exe
                      Source: Halkbank.exe, 00000001.00000002.289972605.0000000002DA1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameIndvGslqFtFYfKpHTgcTQzFewbwOcpef.exe4 vs Halkbank.exe
                      Source: Halkbank.exe, 00000001.00000002.290021625.0000000002DD5000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameInnerException.dll" vs Halkbank.exe
                      Source: Halkbank.exeBinary or memory string: OriginalFilenameSafeBSTRHand.exeJ vs Halkbank.exe
                      Source: Halkbank.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: Halkbank.exeVirustotal: Detection: 19%
                      Source: Halkbank.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Halkbank.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: unknownProcess created: C:\Users\user\Desktop\Halkbank.exe "C:\Users\user\Desktop\Halkbank.exe"
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 1476
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Halkbank.exe.logJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER819B.tmpJump to behavior
                      Source: classification engineClassification label: mal100.troj.adwa.spyw.evad.winEXE@4/8@0/0
                      Source: C:\Users\user\Desktop\Halkbank.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Windows\SysWOW64\WerFault.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Windows\SysWOW64\WerFault.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5972
                      Source: 5.0.RegSvcs.exe.400000.4.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 5.0.RegSvcs.exe.400000.4.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 5.0.RegSvcs.exe.400000.1.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 5.0.RegSvcs.exe.400000.1.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 5.0.RegSvcs.exe.400000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 5.0.RegSvcs.exe.400000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: Halkbank.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: Halkbank.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: rsaenh.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: anagement.pdb source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.ni.pdb% source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: System.ni.pdb" source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000018.00000003.501131452.0000000004FE8000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.501577620.0000000004FE9000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.PDB source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: wbemcomn.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000018.00000003.515947307.0000000005527000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516030444.0000000005527000.00000004.00000040.sdmp
                      Source: Binary string: System.pdb' source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: System.Management.pdbHk source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: .pdb&&=8 source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: ore.ni.pdb" source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: RegSvcs.pdb source: RegSvcs.exe, 00000005.00000000.492318602.000000000602D000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.536059728.000000000602D000.00000004.00000001.sdmp
                      Source: Binary string: .ni.pdb source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: clr.pdb source: WerFault.exe, 00000018.00000003.516018795.0000000005520000.00000004.00000040.sdmp
                      Source: Binary string: cryptsp.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: advapi32.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: oC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdbr source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: wbemcomn.pdb& source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: vaultcli.pdb8 source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Configuration.ni.pdb" source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: CLBCatQ.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Configuration.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: System.pdb"" source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000018.00000003.501258894.0000000003025000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.501634756.0000000003025000.00000004.00000001.sdmp
                      Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbu source: RegSvcs.exe, 00000005.00000002.534261296.0000000001125000.00000004.00000020.sdmp, RegSvcs.exe, 00000005.00000000.493739799.0000000001125000.00000004.00000020.sdmp
                      Source: Binary string: \??\C:\Windows\RegSvcs.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: sxs.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Xml.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: indows.Forms.pdb source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: RegSvcs.PDB source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: mscoree.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: ws2_32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: mscorlib.pdb@ source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: shlwapi.pdbk source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: wbemdisp.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: RegSvcs.pdbegSvcs.pdbpdbvcs.pdbv4.0.30319\RegSvcs.pdb3062332-1002 source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: RegSvcs.pdb, source: RegSvcs.exe, 00000005.00000000.492318602.000000000602D000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.536059728.000000000602D000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\RegSvcs.pdb6 source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 00000018.00000003.515947307.0000000005527000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516030444.0000000005527000.00000004.00000040.sdmp
                      Source: Binary string: powrprof.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: msvcr120_clr0400.i386.pdb% source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: mscorlib.ni.pdbRSDS source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: System.Configuration.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: \??\C:\Windows\System.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: ole32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: mscorlib.ni.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: mscorlib.pdb source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Management.pdb source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: combase.pdb source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: \??\C:\Windows\exe\RegSvcs.pdb= source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: RegSvcs.exe, 00000005.00000002.534261296.0000000001125000.00000004.00000020.sdmp, RegSvcs.exe, 00000005.00000000.493739799.0000000001125000.00000004.00000020.sdmp
                      Source: Binary string: wbemprox.pdbb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Configuration.ni.pdbRSDSO* source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: System.Configuration.pdbH source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: CustomMarshalers.pdbCA source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: System.Xml.ni.pdbRSDS source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: RegSvcs.pdbr source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: WinTypes.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Core.ni.pdbRSDSD source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: \??\C:\Windows\symbols\exe\RegSvcs.pdbk source: RegSvcs.exe, 00000005.00000000.490961404.00000000011CB000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.534391615.00000000011CB000.00000004.00000001.sdmp
                      Source: Binary string: diasymreader.pdb_ source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.Management.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: mscorlib.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: mscoreei.pdbk source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: shcore.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Core.ni.pdb% source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: C:\Windows\RegSvcs.pdbpdbvcs.pdb.[ source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: vaultcli.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000018.00000003.516018795.0000000005520000.00000004.00000040.sdmp
                      Source: Binary string: fltLib.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Core.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: shell32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000018.00000003.516018795.0000000005520000.00000004.00000040.sdmp
                      Source: Binary string: \??\C:\Windows\symbols\exe\RegSvcs.pdb source: RegSvcs.exe, 00000005.00000000.490961404.00000000011CB000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.534391615.00000000011CB000.00000004.00000001.sdmp
                      Source: Binary string: o0C:\Windows\RegSvcs.pdb source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: wimm32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Xml.ni.pdbT source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: diasymreader.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: wmiutils.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Xml.pdb{{(9 source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: .pdb source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\symbols\dll\System.pdbd source: RegSvcs.exe, 00000005.00000000.490961404.00000000011CB000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.534391615.00000000011CB000.00000004.00000001.sdmp
                      Source: Binary string: profapi.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.ni.pdbT3%l source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: symbols\exe\RegSvcs.pdbzX source: RegSvcs.exe, 00000005.00000002.533609146.0000000000EF8000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.490547658.0000000000EF8000.00000004.00000001.sdmp
                      Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000018.00000003.516018795.0000000005520000.00000004.00000040.sdmp
                      Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: sechost.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: System.ni.pdbRSDS source: WER819B.tmp.dmp.24.dr
                      Source: Binary string: ws2_32.pdbV source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: clrjit.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: fastprox.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: wbemsvc.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: msctf.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: version.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Xml.pdb source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: CustomMarshalers.pdb source: WerFault.exe, 00000018.00000003.515865466.0000000005538000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: ore.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.pdb source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: System.Windows.Forms.pdb source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000018.00000003.516018795.0000000005520000.00000004.00000040.sdmp
                      Source: Binary string: psapi.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: WMINet_Utils.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\dll\System.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: System.Core.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: mscoreei.pdb source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000018.00000003.501258894.0000000003025000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.501634756.0000000003025000.00000004.00000001.sdmp
                      Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000018.00000003.515915382.0000000005551000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.PDB source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: System.Core.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp, WER819B.tmp.dmp.24.dr
                      Source: Binary string: combase.pdbk source: WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp
                      Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: \??\C:\Windows\exe\RegSvcs.pdb source: RegSvcs.exe, 00000005.00000000.495352147.0000000005FE0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.535968114.0000000005FE0000.00000004.00000001.sdmp
                      Source: Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp
                      Source: Binary string: wuser32.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: Microsoft.VisualBasic.pdb" source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: wbemprox.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp
                      Source: Binary string: System.Xml.ni.pdb" source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515854696.0000000005536000.00000004.00000001.sdmp
                      Source: Binary string: System.ni.pdb source: WerFault.exe, 00000018.00000003.515814367.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.516039599.000000000552A000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.515786951.0000000005521000.00000004.00000040.sdmp, WerFault.exe, 00000018.00000003.515958788.000000000552A000.00000004.00000040.sdmp, WER819B.tmp.dmp.24.dr

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: Halkbank.exe, MegaMan.LevelEditor/MainForm.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 1.0.Halkbank.exe.9f0000.0.unpack, MegaMan.LevelEditor/MainForm.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 1.2.Halkbank.exe.9f0000.0.unpack, MegaMan.LevelEditor/MainForm.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F1718B push 8BFFFFFFh; retf
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.70769358931
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 1.2.Halkbank.exe.2ded24c.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.289972605.0000000002DA1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.290021625.0000000002DD5000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Halkbank.exe PID: 6272, type: MEMORYSTR
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: Halkbank.exe, 00000001.00000002.289972605.0000000002DA1000.00000004.00000001.sdmp, Halkbank.exe, 00000001.00000002.290021625.0000000002DD5000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: Halkbank.exe, 00000001.00000002.289972605.0000000002DA1000.00000004.00000001.sdmp, Halkbank.exe, 00000001.00000002.290021625.0000000002DD5000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\Halkbank.exe TID: 6016Thread sleep time: -36926s >= -30000s
                      Source: C:\Users\user\Desktop\Halkbank.exe TID: 3340Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\Halkbank.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 3217
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 6617
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank.exeThread delayed: delay time: 36926
                      Source: C:\Users\user\Desktop\Halkbank.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: Halkbank.exe, 00000001.00000002.290021625.0000000002DD5000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
                      Source: Amcache.hve.24.drBinary or memory string: VMware
                      Source: Amcache.hve.24.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
                      Source: Amcache.hve.24.drBinary or memory string: VMware Virtual USB Mouse
                      Source: Halkbank.exe, 00000001.00000002.290021625.0000000002DD5000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: Amcache.hve.24.drBinary or memory string: VMware, Inc.
                      Source: Amcache.hve.24.drBinary or memory string: VMware Virtual disk SCSI Disk Devicehbin
                      Source: WerFault.exe, 00000018.00000003.529964299.0000000004FD6000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000002.532467720.0000000004FD6000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000002.532293810.0000000004EB0000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.529529898.0000000004FD6000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
                      Source: Amcache.hve.24.drBinary or memory string: VMware, Inc.me
                      Source: WerFault.exe, 00000018.00000003.529466977.0000000004FE0000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000002.532482185.0000000004FE2000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAWh
                      Source: Halkbank.exe, 00000001.00000002.290021625.0000000002DD5000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                      Source: Amcache.hve.24.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
                      Source: Amcache.hve.24.drBinary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
                      Source: Halkbank.exe, 00000001.00000002.290021625.0000000002DD5000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: WerFault.exe, 00000018.00000003.527444365.0000000004FE8000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2
                      Source: Amcache.hve.24.drBinary or memory string: Microsoft Hyper-V Generation Counter
                      Source: Amcache.hve.24.drBinary or memory string: VMware7,1
                      Source: Amcache.hve.24.drBinary or memory string: NECVMWar VMware SATA CD00
                      Source: Amcache.hve.24.drBinary or memory string: VMware Virtual disk SCSI Disk Device
                      Source: Amcache.hve.24.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
                      Source: Amcache.hve.24.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
                      Source: Amcache.hve.24.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
                      Source: Amcache.hve.24.drBinary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
                      Source: Amcache.hve.24.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess queried: DebugPort
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess queried: DebugPort
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_00F1C308 LdrInitializeThunk,
                      Source: C:\Users\user\Desktop\Halkbank.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Writes to foreign memory regionsShow sources
                      Source: C:\Users\user\Desktop\Halkbank.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
                      Source: C:\Users\user\Desktop\Halkbank.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
                      Source: C:\Users\user\Desktop\Halkbank.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 438000
                      Source: C:\Users\user\Desktop\Halkbank.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43A000
                      Source: C:\Users\user\Desktop\Halkbank.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: DF8008
                      Modifies the hosts fileShow sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Allocates memory in foreign processesShow sources
                      Source: C:\Users\user\Desktop\Halkbank.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\Halkbank.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\Desktop\Halkbank.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      Source: RegSvcs.exe, 00000005.00000000.494112429.0000000001810000.00000002.00020000.sdmp, RegSvcs.exe, 00000005.00000000.491193047.0000000001810000.00000002.00020000.sdmpBinary or memory string: Program Manager
                      Source: RegSvcs.exe, 00000005.00000000.494112429.0000000001810000.00000002.00020000.sdmp, RegSvcs.exe, 00000005.00000000.491193047.0000000001810000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: RegSvcs.exe, 00000005.00000000.494112429.0000000001810000.00000002.00020000.sdmp, RegSvcs.exe, 00000005.00000000.491193047.0000000001810000.00000002.00020000.sdmpBinary or memory string: Progman
                      Source: RegSvcs.exe, 00000005.00000000.494112429.0000000001810000.00000002.00020000.sdmp, RegSvcs.exe, 00000005.00000000.491193047.0000000001810000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Halkbank.exeQueries volume information: C:\Users\user\Desktop\Halkbank.exe VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                      Lowering of HIPS / PFW / Operating System Security Settings:

                      barindex
                      Modifies the hosts fileShow sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: Amcache.hve.24.dr, Amcache.hve.LOG1.24.drBinary or memory string: c:\users\user\desktop\procexp.exe
                      Source: Amcache.hve.24.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
                      Source: Amcache.hve.24.dr, Amcache.hve.LOG1.24.drBinary or memory string: procexp.exe

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 1.2.Halkbank.exe.3e39bb8.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank.exe.3e04198.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank.exe.3e39bb8.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank.exe.3e04198.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000005.00000000.493010505.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.287151735.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.290543372.0000000003DA9000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.287966874.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.288288058.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.490385199.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.533288791.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.287632370.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.534823642.0000000002E21000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.491312153.0000000002E21000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.494379610.0000000002ED8000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.491463925.0000000002ED8000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.535018721.0000000002ED8000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.494208216.0000000002E21000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Halkbank.exe PID: 6272, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 5972, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: WerFault.exe PID: 4232, type: MEMORYSTR
                      Tries to steal Mail credentials (via file / registry access)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                      Source: Yara matchFile source: 00000005.00000002.534823642.0000000002E21000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.491312153.0000000002E21000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.494208216.0000000002E21000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 5972, type: MEMORYSTR

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 1.2.Halkbank.exe.3e39bb8.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank.exe.3e04198.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank.exe.3e39bb8.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank.exe.3e04198.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000005.00000000.493010505.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.287151735.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.290543372.0000000003DA9000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.287966874.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.288288058.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.490385199.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.533288791.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.287632370.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000018.00000003.513792403.0000000005780000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.534823642.0000000002E21000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.491312153.0000000002E21000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.494379610.0000000002ED8000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.491463925.0000000002ED8000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.535018721.0000000002ED8000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.494208216.0000000002E21000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Halkbank.exe PID: 6272, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 5972, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: WerFault.exe PID: 4232, type: MEMORYSTR

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Path InterceptionProcess Injection312Masquerading1OS Credential Dumping1Security Software Discovery231Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsFile and Directory Permissions Modification1LSASS MemoryProcess Discovery1Remote Desktop ProtocolArchive Collected Data11Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools1Security Account ManagerVirtualization/Sandbox Evasion141SMB/Windows Admin SharesData from Local System1Automated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Virtualization/Sandbox Evasion141NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptProcess Injection312LSA SecretsRemote System Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonDeobfuscate/Decode Files or Information1Cached Domain CredentialsSystem Information Discovery114VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsObfuscated Files or Information2DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobSoftware Packing13Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi