Windows Analysis Report Doc3038210381 pdf.html

AV Detection:

Yara detected FormBook

Source: Yara match	File source: 44.2.Doc3038210381 (2).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.Doc3038210381 (2).exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000038.00000002.1067590564.0000000002960000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000000.896879131.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.1066540925.00000000005A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.1067661415.0000000002990000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.971832509.00000000010E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.947225633.000000000691F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.977919600.0000000003499000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.932775255.000000000691F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1012428415.0000000000E90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000000.972238281.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1012381987.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.903704125.0000000003419000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003D.00000002.1018113632.0000000002F90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000000.897454955.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.971108516.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.972028114.00000000014F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000000.971453984.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1011928391.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Antivirus or Machine Learning detection for unpacked file

Source: 44.2.Doc3038210381 (2).exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 44.0.Doc3038210381 (2).exe.400000.6.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 44.0.Doc3038210381 (2).exe.400000.8.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 44.0.Doc3038210381 (2).exe.400000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Phishing:

Phishing site detected (based on favicon image match)

Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match	File source: 93690.0.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, type: DROPPED

Phishing site detected (based on logo template match)

Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/

Matcher: Template: onedrive matched

No HTML title found

Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/	HTTP Parser: HTML title missing
Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/	HTTP Parser: HTML title missing

HTML body contains low number of good links

Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/	HTTP Parser: Number of links: 0
Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/	HTTP Parser: Number of links: 0

META author tag missing

Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/	HTTP Parser: No <meta name="author".. found
Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/	HTTP Parser: No <meta name="copyright".. found
Source: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/	HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\6392_1721576700\LICENSE.txt

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: control.pdb source: Doc3038210381 (2).exe, 0000002C.00000002.974746974.0000000003440000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Doc3038210381 (2).exe, 0000002C.00000002.972336056.000000000164F000.00000040.00000001.sdmp, Doc3038210381 (2).exe, 0000002C.00000002.972109054.0000000001530000.00000040.00000001.sdmp, control.exe, 00000038.00000002.1068850336.0000000004790000.00000040.00000001.sdmp, control.exe, 00000038.00000002.1069444007.00000000048AF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Doc3038210381 (2).exe, 0000002C.00000002.972336056.000000000164F000.00000040.00000001.sdmp, Doc3038210381 (2).exe, 0000002C.00000002.972109054.0000000001530000.00000040.00000001.sdmp, control.exe, control.exe, 00000038.00000002.1068850336.0000000004790000.00000040.00000001.sdmp, control.exe, 00000038.00000002.1069444007.00000000048AF000.00000040.00000001.sdmp
Source:	Binary string: control.pdbUGP source: Doc3038210381 (2).exe, 0000002C.00000002.974746974.0000000003440000.00000040.00020000.sdmp

Networking:

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

URLs found in memory or binary data

Source: Doc3038210381 (2).exe, 00000029.00000003.862726633.00000000053D8000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.862933656.00000000053D8000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.862866326.00000000053D8000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.862796803.00000000053D8000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.862831668.00000000053D8000.00000004.00000001.sdmp	String found in binary or memory: http://en.w
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Doc3038210381 (2).exe, 00000029.00000003.865552543.00000000053B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Doc3038210381 (2).exe, 00000029.00000003.865552543.00000000053B2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Doc3038210381 (2).exe, 00000029.00000003.873490954.00000000053C0000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873229883.00000000053C5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873135855.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com.TTF
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Doc3038210381 (2).exe, 00000029.00000003.871793757.00000000053F9000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Doc3038210381 (2).exe, 00000029.00000003.871917834.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.872017026.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871855146.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871828013.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871793757.00000000053F9000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmly
Source: Doc3038210381 (2).exe, 00000029.00000003.871451264.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871571882.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871607463.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.870906646.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871491389.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871720538.00000000053FD000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871209392.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871664031.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871131724.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871170984.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871087070.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871300121.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871360971.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.871516053.00000000053F9000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Doc3038210381 (2).exe, 00000029.00000003.870906646.00000000053F9000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html.
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Doc3038210381 (2).exe, 00000029.00000003.871053494.00000000053C6000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873490954.00000000053C0000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873229883.00000000053C5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.870396469.00000000053C6000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873135855.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: Doc3038210381 (2).exe, 00000029.00000003.880931034.00000000053C4000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.881137204.00000000053C4000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: Doc3038210381 (2).exe, 00000029.00000003.873490954.00000000053C0000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873229883.00000000053C5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873135855.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalsdJ
Source: Doc3038210381 (2).exe, 00000029.00000003.873490954.00000000053C0000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873229883.00000000053C5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873135855.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comcom
Source: Doc3038210381 (2).exe, 00000029.00000003.871053494.00000000053C6000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comcomd
Source: Doc3038210381 (2).exe, 00000029.00000003.870396469.00000000053C6000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.870140763.00000000053C4000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: Doc3038210381 (2).exe, 00000029.00000002.906311777.00000000053B7000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.880931034.00000000053C4000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.881137204.00000000053C4000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.900165590.00000000053B7000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.come.comn
Source: Doc3038210381 (2).exe, 00000029.00000003.870140763.00000000053C4000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: Doc3038210381 (2).exe, 00000029.00000002.906311777.00000000053B7000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.880931034.00000000053C4000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.881137204.00000000053C4000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.900165590.00000000053B7000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comion
Source: Doc3038210381 (2).exe, 00000029.00000002.906311777.00000000053B7000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.880931034.00000000053C4000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.881137204.00000000053C4000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.900165590.00000000053B7000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: Doc3038210381 (2).exe, 00000029.00000003.870396469.00000000053C6000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comoitu
Source: Doc3038210381 (2).exe, 00000029.00000003.873490954.00000000053C0000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873229883.00000000053C5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.873135855.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comrsivC
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Doc3038210381 (2).exe, 00000029.00000003.863183094.00000000053D9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.863551210.00000000053D9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.863416770.00000000053D9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.863316431.00000000053D9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.863521957.00000000053D9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.863475227.00000000053D9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.863110412.00000000053D9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.863091185.00000000053D8000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.863159086.00000000053D9000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com;
Source: Doc3038210381 (2).exe, 00000029.00000003.864975303.00000000053BF000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864538937.00000000053BF000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864411840.00000000053E2000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864401242.00000000053DD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Doc3038210381 (2).exe, 00000029.00000003.864684252.00000000053DD000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864853143.00000000053DE000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864860998.00000000053E3000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864761751.00000000053DE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn%
Source: Doc3038210381 (2).exe, 00000029.00000003.864684252.00000000053DD000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864104295.00000000053DE000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864761751.00000000053DE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Doc3038210381 (2).exe, 00000029.00000003.864538937.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnY
Source: Doc3038210381 (2).exe, 00000029.00000003.864975303.00000000053BF000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864538937.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnto
Source: Doc3038210381 (2).exe, 00000029.00000003.864538937.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cntuk
Source: Doc3038210381 (2).exe, 00000029.00000003.875924170.00000000053C5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.875275379.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.875323220.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.875655876.00000000053C5000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: Doc3038210381 (2).exe, 00000029.00000003.875275379.00000000053F9000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.875323220.00000000053F9000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/6
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Doc3038210381 (2).exe, 00000029.00000003.866508472.00000000053BC000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.867351021.00000000053BC000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.866508472.00000000053BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/6
Source: Doc3038210381 (2).exe, 00000029.00000003.866132631.00000000053B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/A
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.867351021.00000000053BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/J
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.867351021.00000000053BC000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.866508472.00000000053BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/X
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.867351021.00000000053BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.867351021.00000000053BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-e
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.867351021.00000000053BC000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.866508472.00000000053BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/a-de
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.867351021.00000000053BC000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.866508472.00000000053BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.867351021.00000000053BC000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.866508472.00000000053BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/A
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.867351021.00000000053BC000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.866132631.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.866508472.00000000053BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s
Source: Doc3038210381 (2).exe, 00000029.00000003.866939317.00000000053B5000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.866508472.00000000053BC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s_tr
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Doc3038210381 (2).exe, 00000029.00000003.864104295.00000000053DE000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr=
Source: Doc3038210381 (2).exe, 00000029.00000003.864205415.00000000053DE000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864324190.00000000053DE000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864255916.00000000053DE000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864104295.00000000053DE000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000003.864288572.00000000053DE000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krI
Source: Doc3038210381 (2).exe, 00000029.00000003.864009291.00000000053DE000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krr-tN
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Doc3038210381 (2).exe, 00000029.00000003.865259302.00000000053B2000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000002.906737345.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /file-7564c3328869m00865113607754b653 HTTP/1.1Host: ghostdownload.sbsConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /file-7564c3328869m00865113607754b653/ HTTP/1.1Host: ghostdownload.sbsConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /file-7564c3328869m00865113607754b653/assets/css/main.min.css HTTP/1.1Host: ghostdownload.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /file-7564c3328869m00865113607754b653/assets/js/main.js HTTP/1.1Host: ghostdownload.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /file-7564c3328869m00865113607754b653/assets/images/white-onedrive.02a11105.svg HTTP/1.1Host: ghostdownload.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /file-7564c3328869m00865113607754b653/assets/images/pdf.png HTTP/1.1Host: ghostdownload.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /file-7564c3328869m00865113607754b653/assets/images/outlook-anim.c9d7cfd2.gif HTTP/1.1Host: ghostdownload.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /file-7564c3328869m00865113607754b653/favicon.png HTTP/1.1Host: ghostdownload.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/file.exe HTTP/1.1Host: ghostdownload.sbsConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ghostdownload.sbs/file-7564c3328869m00865113607754b653/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 44.2.Doc3038210381 (2).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.Doc3038210381 (2).exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000038.00000002.1067590564.0000000002960000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000000.896879131.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.1066540925.00000000005A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.1067661415.0000000002990000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.971832509.00000000010E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.947225633.000000000691F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.977919600.0000000003499000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.932775255.000000000691F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1012428415.0000000000E90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000000.972238281.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1012381987.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.903704125.0000000003419000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003D.00000002.1018113632.0000000002F90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000000.897454955.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.971108516.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.972028114.00000000014F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000000.971453984.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1011928391.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Source: 44.2.Doc3038210381 (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 44.2.Doc3038210381 (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 44.0.Doc3038210381 (2).exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 44.0.Doc3038210381 (2).exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 44.0.Doc3038210381 (2).exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 44.0.Doc3038210381 (2).exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 44.0.Doc3038210381 (2).exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 44.0.Doc3038210381 (2).exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 44.0.Doc3038210381 (2).exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 44.0.Doc3038210381 (2).exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 44.0.Doc3038210381 (2).exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 44.0.Doc3038210381 (2).exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 44.2.Doc3038210381 (2).exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 44.2.Doc3038210381 (2).exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000038.00000002.1067590564.0000000002960000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000038.00000002.1067590564.0000000002960000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000002C.00000000.896879131.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000002C.00000000.896879131.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000038.00000002.1066540925.00000000005A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000038.00000002.1066540925.00000000005A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000038.00000002.1067661415.0000000002990000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000038.00000002.1067661415.0000000002990000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000002C.00000002.971832509.00000000010E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000002C.00000002.971832509.00000000010E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000002D.00000000.947225633.000000000691F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000002D.00000000.947225633.000000000691F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000037.00000002.977919600.0000000003499000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000037.00000002.977919600.0000000003499000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000002D.00000000.932775255.000000000691F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000002D.00000000.932775255.000000000691F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000039.00000002.1012428415.0000000000E90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000039.00000002.1012428415.0000000000E90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000039.00000000.972238281.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000039.00000000.972238281.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000039.00000002.1012381987.0000000000E60000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000039.00000002.1012381987.0000000000E60000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000029.00000002.903704125.0000000003419000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000029.00000002.903704125.0000000003419000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000003D.00000002.1018113632.0000000002F90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000003D.00000002.1018113632.0000000002F90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000002C.00000000.897454955.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000002C.00000000.897454955.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000002C.00000002.971108516.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000002C.00000002.971108516.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000002C.00000002.972028114.00000000014F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000002C.00000002.972028114.00000000014F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000039.00000000.971453984.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000039.00000000.971453984.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000039.00000002.1011928391.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000039.00000002.1011928391.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Yara signature match

Source: 44.2.Doc3038210381 (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 44.2.Doc3038210381 (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 44.0.Doc3038210381 (2).exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 44.0.Doc3038210381 (2).exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 44.0.Doc3038210381 (2).exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 44.0.Doc3038210381 (2).exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 44.0.Doc3038210381 (2).exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 44.0.Doc3038210381 (2).exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 44.0.Doc3038210381 (2).exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 44.0.Doc3038210381 (2).exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 44.0.Doc3038210381 (2).exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 44.0.Doc3038210381 (2).exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 44.2.Doc3038210381 (2).exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 44.2.Doc3038210381 (2).exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000038.00000002.1067590564.0000000002960000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000038.00000002.1067590564.0000000002960000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000002C.00000000.896879131.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000002C.00000000.896879131.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000038.00000002.1066540925.00000000005A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000038.00000002.1066540925.00000000005A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000038.00000002.1067661415.0000000002990000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000038.00000002.1067661415.0000000002990000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000002C.00000002.971832509.00000000010E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000002C.00000002.971832509.00000000010E0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000002D.00000000.947225633.000000000691F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000002D.00000000.947225633.000000000691F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000037.00000002.977919600.0000000003499000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000037.00000002.977919600.0000000003499000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000002D.00000000.932775255.000000000691F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000002D.00000000.932775255.000000000691F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000039.00000002.1012428415.0000000000E90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000039.00000002.1012428415.0000000000E90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000039.00000000.972238281.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000039.00000000.972238281.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000039.00000002.1012381987.0000000000E60000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000039.00000002.1012381987.0000000000E60000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000029.00000002.903704125.0000000003419000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000029.00000002.903704125.0000000003419000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000003D.00000002.1018113632.0000000002F90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000003D.00000002.1018113632.0000000002F90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000002C.00000000.897454955.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000002C.00000000.897454955.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000002C.00000002.971108516.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000002C.00000002.971108516.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000002C.00000002.972028114.00000000014F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000002C.00000002.972028114.00000000014F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000039.00000000.971453984.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000039.00000000.971453984.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000039.00000002.1011928391.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000039.00000002.1011928391.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Detected potential crypto function

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 41_2_00062050		41_2_00062050
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 41_2_0091C884		41_2_0091C884
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 41_2_0091EC50		41_2_0091EC50
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 41_2_0091EC40		41_2_0091EC40
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 41_2_06DEC4B8		41_2_06DEC4B8
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 41_2_06DE0040		41_2_06DE0040
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 43_2_00022050		43_2_00022050
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041E803		44_2_0041E803
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_00401030		44_2_00401030
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041DA21		44_2_0041DA21
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041C3E7		44_2_0041C3E7
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041ED07		44_2_0041ED07
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_00402D8B		44_2_00402D8B
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_00402D90		44_2_00402D90
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_00409E60		44_2_00409E60
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_00402FB0		44_2_00402FB0
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_00AC2050		44_2_00AC2050
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Code function: 55_2_000C223D		55_2_000C223D
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Code function: 55_2_0230C884		55_2_0230C884
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Code function: 55_2_0230EC50		55_2_0230EC50
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Code function: 55_2_0230EC40		55_2_0230EC40
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Code function: 55_2_0684C400		55_2_0684C400
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Code function: 55_2_06840040		55_2_06840040
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C841F		56_2_047C841F
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487D466		56_2_0487D466
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048825DD		56_2_048825DD
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B0D20		56_2_047B0D20
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04882D07		56_2_04882D07
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CD5E0		56_2_047CD5E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04881D55		56_2_04881D55
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E2581		56_2_047E2581
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D6E30		56_2_047D6E30
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04882EF7		56_2_04882EF7
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487D616		56_2_0487D616
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0488DFCE		56_2_0488DFCE
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04881FF1		56_2_04881FF1
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048820A8		56_2_048820A8
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA830		56_2_047DA830
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048828EC		56_2_048828EC
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871002		56_2_04871002
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0488E824		56_2_0488E824
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E20A0		56_2_047E20A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CB090		56_2_047CB090
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D4120		56_2_047D4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BF900		56_2_047BF900
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048822AE		56_2_048822AE
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0486FA2B		56_2_0486FA2B
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DAB40		56_2_047DAB40
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487DBD2		56_2_0487DBD2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048703DA		56_2_048703DA
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04882B28		56_2_04882B28
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EEBB0		56_2_047EEBB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BE803		56_2_005BE803
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BC3E7		56_2_005BC3E7
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005A2D90		56_2_005A2D90
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005A2D8B		56_2_005A2D8B
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005A9E60		56_2_005A9E60
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005A2FB0		56_2_005A2FB0

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\control.exe

Code function: String function: 047BB150 appears 72 times

Contains functionality to call native functions

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041A360 NtCreateFile,		44_2_0041A360
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041A410 NtReadFile,		44_2_0041A410
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041A490 NtClose,		44_2_0041A490
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041A540 NtAllocateVirtualMemory,		44_2_0041A540
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041A48A NtClose,		44_2_0041A48A
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041A53A NtAllocateVirtualMemory,		44_2_0041A53A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9540 NtReadFile,LdrInitializeThunk,		56_2_047F9540
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F95D0 NtClose,LdrInitializeThunk,		56_2_047F95D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9660 NtAllocateVirtualMemory,LdrInitializeThunk,		56_2_047F9660
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F96E0 NtFreeVirtualMemory,LdrInitializeThunk,		56_2_047F96E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9FE0 NtCreateMutant,LdrInitializeThunk,		56_2_047F9FE0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9860 NtQuerySystemInformation,LdrInitializeThunk,		56_2_047F9860
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9910 NtAdjustPrivilegesToken,LdrInitializeThunk,		56_2_047F9910
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9A50 NtCreateFile,LdrInitializeThunk,		56_2_047F9A50
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9560 NtWriteFile,		56_2_047F9560
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047FAD30 NtSetContextThread,		56_2_047FAD30
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9520 NtWaitForSingleObject,		56_2_047F9520
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F95F0 NtQueryInformationFile,		56_2_047F95F0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9670 NtQueryInformationProcess,		56_2_047F9670
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9650 NtQueryValueKey,		56_2_047F9650
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9610 NtEnumerateValueKey,		56_2_047F9610
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F96D0 NtCreateKey,		56_2_047F96D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9770 NtSetInformationFile,		56_2_047F9770
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047FA770 NtOpenThread,		56_2_047FA770
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9760 NtOpenProcess,		56_2_047F9760
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9730 NtQueryVirtualMemory,		56_2_047F9730
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047FA710 NtOpenProcessToken,		56_2_047FA710
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9710 NtQueryInformationToken,		56_2_047F9710
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F97A0 NtUnmapViewOfSection,		56_2_047F97A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9780 NtMapViewOfSection,		56_2_047F9780
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047FB040 NtSuspendThread,		56_2_047FB040
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9840 NtDelayExecution,		56_2_047F9840
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9820 NtEnumerateKey,		56_2_047F9820
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F98F0 NtReadVirtualMemory,		56_2_047F98F0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F98A0 NtWriteVirtualMemory,		56_2_047F98A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9950 NtQueueApcThread,		56_2_047F9950
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F99D0 NtCreateProcessEx,		56_2_047F99D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F99A0 NtCreateSection,		56_2_047F99A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9A20 NtResumeThread,		56_2_047F9A20
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9A10 NtQuerySection,		56_2_047F9A10
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9A00 NtProtectVirtualMemory,		56_2_047F9A00
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9A80 NtOpenDirectoryObject,		56_2_047F9A80
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F9B00 NtSetValueKey,		56_2_047F9B00
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047FA3B0 NtGetContextThread,		56_2_047FA3B0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BA360 NtCreateFile,		56_2_005BA360
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BA410 NtReadFile,		56_2_005BA410
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BA490 NtClose,		56_2_005BA490
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BA540 NtAllocateVirtualMemory,		56_2_005BA540
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BA48A NtClose,		56_2_005BA48A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BA53A NtAllocateVirtualMemory,		56_2_005BA53A

PE file contains strange resources

Source: 5411e7fa-2199-4da4-990b-df91fb32b40a.tmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4f870255-2209-42f9-ab62-1ead63453b3f.tmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: e2073800-0377-4e56-9a3b-e68c781ee936.tmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8874a5b0-7270-4796-9cfc-b2b7e005cc70.tmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: f02771c4-2f22-486a-a4c1-04a87278f8d7.tmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ae5b21db-5534-4929-9ab1-055e16e96744.tmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: 5411e7fa-2199-4da4-990b-df91fb32b40a.tmp.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 4f870255-2209-42f9-ab62-1ead63453b3f.tmp.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: e2073800-0377-4e56-9a3b-e68c781ee936.tmp.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 8874a5b0-7270-4796-9cfc-b2b7e005cc70.tmp.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: f02771c4-2f22-486a-a4c1-04a87278f8d7.tmp.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ae5b21db-5534-4929-9ab1-055e16e96744.tmp.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\Doc3038210381 pdf.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1928 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3256 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3560 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3536 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3308 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5888 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3024 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3236 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3576 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4216 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4228 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4128 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5752 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5040 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3668 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4960 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3596 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5860 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5704 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4684 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3408 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4236 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5788 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3704 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5704 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3968 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Doc3038210381 (2).exe "C:\Users\user\Downloads\Doc3038210381 (2).exe"
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process created: C:\Users\user\Downloads\Doc3038210381 (2).exe C:\Users\user\Downloads\Doc3038210381 (2).exe
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process created: C:\Users\user\Downloads\Doc3038210381 (2).exe C:\Users\user\Downloads\Doc3038210381 (2).exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5664 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4496 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5488 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3652 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5652 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5884 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3968 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3704 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3820 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Doc3038210381 (4).exe "C:\Users\user\Downloads\Doc3038210381 (4).exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\control.exe C:\Windows\SysWOW64\control.exe
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process created: C:\Users\user\Downloads\Doc3038210381 (4).exe C:\Users\user\Downloads\Doc3038210381 (4).exe
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Downloads\Doc3038210381 (2).exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3612 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4236 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4128 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4460 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1928 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Downloads\Doc3038210381 (2).exe"			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3576 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5884 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3256 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3560 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3536 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3308 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5888 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3024 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3236 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3576 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4216 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4228 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4128 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3236 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5752 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5040 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3668 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4960 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3596 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5860 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5704 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4684 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3408 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4236 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5788 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3704 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5704 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3968 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Doc3038210381 (2).exe "C:\Users\user\Downloads\Doc3038210381 (2).exe"			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5664 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4496 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5488 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3652 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5652 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=5884 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3968 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3704 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3820 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Doc3038210381 (4).exe "C:\Users\user\Downloads\Doc3038210381 (4).exe"			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3612 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=3704 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4236 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=icon_reader --enable-audio-service-sandbox --mojo-platform-channel-handle=4128 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1516,3288991115567119224,7010409812870976589,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4460 /prefetch:8			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process created: C:\Users\user\Downloads\Doc3038210381 (2).exe C:\Users\user\Downloads\Doc3038210381 (2).exe			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process created: C:\Users\user\Downloads\Doc3038210381 (2).exe C:\Users\user\Downloads\Doc3038210381 (2).exe			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process created: C:\Users\user\Downloads\Doc3038210381 (4).exe C:\Users\user\Downloads\Doc3038210381 (4).exe
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Downloads\Doc3038210381 (2).exe"

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61E0940A-18F8.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\f1341b53-c02f-4d23-a85a-f43bd5a47c07.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.phis.troj.evad.winHTML@131/299@5/12

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Launches a second explorer.exe instance

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\explorer.exe

Found GUI installer (many successful clicks)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: control.pdb source: Doc3038210381 (2).exe, 0000002C.00000002.974746974.0000000003440000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Doc3038210381 (2).exe, 0000002C.00000002.972336056.000000000164F000.00000040.00000001.sdmp, Doc3038210381 (2).exe, 0000002C.00000002.972109054.0000000001530000.00000040.00000001.sdmp, control.exe, 00000038.00000002.1068850336.0000000004790000.00000040.00000001.sdmp, control.exe, 00000038.00000002.1069444007.00000000048AF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Doc3038210381 (2).exe, 0000002C.00000002.972336056.000000000164F000.00000040.00000001.sdmp, Doc3038210381 (2).exe, 0000002C.00000002.972109054.0000000001530000.00000040.00000001.sdmp, control.exe, control.exe, 00000038.00000002.1068850336.0000000004790000.00000040.00000001.sdmp, control.exe, 00000038.00000002.1069444007.00000000048AF000.00000040.00000001.sdmp
Source:	Binary string: control.pdbUGP source: Doc3038210381 (2).exe, 0000002C.00000002.974746974.0000000003440000.00000040.00020000.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Source: 5411e7fa-2199-4da4-990b-df91fb32b40a.tmp.0.dr, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4f870255-2209-42f9-ab62-1ead63453b3f.tmp.0.dr, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: e2073800-0377-4e56-9a3b-e68c781ee936.tmp.0.dr, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8874a5b0-7270-4796-9cfc-b2b7e005cc70.tmp.0.dr, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: f02771c4-2f22-486a-a4c1-04a87278f8d7.tmp.0.dr, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: ae5b21db-5534-4929-9ab1-055e16e96744.tmp.0.dr, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 41.2.Doc3038210381 (2).exe.60000.0.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 41.0.Doc3038210381 (2).exe.60000.0.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 43.0.Doc3038210381 (2).exe.20000.0.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 43.0.Doc3038210381 (2).exe.20000.1.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 43.0.Doc3038210381 (2).exe.20000.2.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 43.2.Doc3038210381 (2).exe.20000.0.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 43.0.Doc3038210381 (2).exe.20000.3.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 44.0.Doc3038210381 (2).exe.ac0000.2.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 44.2.Doc3038210381 (2).exe.ac0000.1.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 44.0.Doc3038210381 (2).exe.ac0000.0.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 44.0.Doc3038210381 (2).exe.ac0000.3.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 44.0.Doc3038210381 (2).exe.ac0000.1.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 44.0.Doc3038210381 (2).exe.ac0000.7.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 44.0.Doc3038210381 (2).exe.ac0000.9.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 44.0.Doc3038210381 (2).exe.ac0000.5.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 55.0.Doc3038210381 (4).exe.c0000.0.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 55.2.Doc3038210381 (4).exe.c0000.0.unpack, Display.cs	.Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Source: 5411e7fa-2199-4da4-990b-df91fb32b40a.tmp.0.dr, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 4f870255-2209-42f9-ab62-1ead63453b3f.tmp.0.dr, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: e2073800-0377-4e56-9a3b-e68c781ee936.tmp.0.dr, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 8874a5b0-7270-4796-9cfc-b2b7e005cc70.tmp.0.dr, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: f02771c4-2f22-486a-a4c1-04a87278f8d7.tmp.0.dr, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: ae5b21db-5534-4929-9ab1-055e16e96744.tmp.0.dr, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 41.2.Doc3038210381 (2).exe.60000.0.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 41.0.Doc3038210381 (2).exe.60000.0.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 43.0.Doc3038210381 (2).exe.20000.0.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 43.0.Doc3038210381 (2).exe.20000.1.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 43.0.Doc3038210381 (2).exe.20000.2.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 43.2.Doc3038210381 (2).exe.20000.0.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 43.0.Doc3038210381 (2).exe.20000.3.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 44.0.Doc3038210381 (2).exe.ac0000.2.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 44.0.Doc3038210381 (2).exe.ac0000.0.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 44.0.Doc3038210381 (2).exe.ac0000.3.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 44.0.Doc3038210381 (2).exe.ac0000.1.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 44.0.Doc3038210381 (2).exe.ac0000.7.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 44.0.Doc3038210381 (2).exe.ac0000.9.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 44.0.Doc3038210381 (2).exe.ac0000.5.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 55.0.Doc3038210381 (4).exe.c0000.0.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 55.2.Doc3038210381 (4).exe.c0000.0.unpack, Display.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 41_2_0006F707 push esp; iretd		41_2_0006F70A
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 41_2_0091DE88 push esp; iretd		41_2_0091DE89
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 43_2_0002F707 push esp; iretd		43_2_0002F70A
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041D833 push ebp; ret		44_2_0041D8AB
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041D8AD push ebp; ret		44_2_0041D8AB
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041117C push edi; iretd		44_2_0041117F
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_00406C66 push es; iretd		44_2_00406C69
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041D4B5 push eax; ret		44_2_0041D508
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_00416557 push ecx; retf		44_2_00416558
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041D56C push eax; ret		44_2_0041D572
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041D502 push eax; ret		44_2_0041D508
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_0041D50B push eax; ret		44_2_0041D572
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Code function: 44_2_00ACF707 push esp; iretd		44_2_00ACF70A
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Code function: 55_2_000CF707 push esp; iretd		55_2_000CF70A
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Code function: 55_2_0230DE88 push esp; iretd		55_2_0230DE89
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0480D0D1 push ecx; ret		56_2_0480D0E4
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BD833 push ebp; ret		56_2_005BD8AB
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BD8AD push ebp; ret		56_2_005BD8AB
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005B117C push edi; iretd		56_2_005B117F
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005A6C66 push es; iretd		56_2_005A6C69
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BD4B5 push eax; ret		56_2_005BD508
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005B6557 push ecx; retf		56_2_005B6558
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BD56C push eax; ret		56_2_005BD572
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BD50B push eax; ret		56_2_005BD572
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BD502 push eax; ret		56_2_005BD508
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_005BEF0C push ds; ret		56_2_005BEF0D

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: .text entropy: 7.76256369421
Source: initial sample	Static PE information: section name: .text entropy: 7.76256369421
Source: initial sample	Static PE information: section name: .text entropy: 7.76256369421
Source: initial sample	Static PE information: section name: .text entropy: 7.76256369421
Source: initial sample	Static PE information: section name: .text entropy: 7.76256369421
Source: initial sample	Static PE information: section name: .text entropy: 7.76256369421

Persistence and Installation Behavior:

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\8874a5b0-7270-4796-9cfc-b2b7e005cc70.tmp			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 448908.crdownloadop (copy)			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 802418.crdownload (copy)			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\5411e7fa-2199-4da4-990b-df91fb32b40a.tmp			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\e2073800-0377-4e56-9a3b-e68c781ee936.tmp			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 236471.crdownloadp (copy)			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\ae5b21db-5534-4929-9ab1-055e16e96744.tmp			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\4f870255-2209-42f9-ab62-1ead63453b3f.tmp			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 771353.crdownload (copy)			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 2864.crdownload (copy)			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 13307.crdownload (copy)			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\f02771c4-2f22-486a-a4c1-04a87278f8d7.tmp			Jump to dropped file

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\6392_1721576700\LICENSE.txt

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x84 0x4E 0xE4

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Source: Yara match	File source: 41.2.Doc3038210381 (2).exe.244782c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 55.2.Doc3038210381 (4).exe.24c782c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.Doc3038210381 (2).exe.243f820.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 55.2.Doc3038210381 (4).exe.24bf820.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 55.2.Doc3038210381 (4).exe.2506630.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.Doc3038210381 (2).exe.2486630.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000037.00000002.976848535.0000000002491000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.977043331.00000000024DA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.903120901.0000000002411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.903179397.000000000245A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Doc3038210381 (2).exe PID: 6592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Doc3038210381 (4).exe PID: 5156, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Doc3038210381 (2).exe, 00000029.00000002.903120901.0000000002411000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000002.903179397.000000000245A000.00000004.00000001.sdmp, Doc3038210381 (4).exe, 00000037.00000002.976848535.0000000002491000.00000004.00000001.sdmp, Doc3038210381 (4).exe, 00000037.00000002.977043331.00000000024DA000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Doc3038210381 (2).exe, 00000029.00000002.903120901.0000000002411000.00000004.00000001.sdmp, Doc3038210381 (2).exe, 00000029.00000002.903179397.000000000245A000.00000004.00000001.sdmp, Doc3038210381 (4).exe, 00000037.00000002.976848535.0000000002491000.00000004.00000001.sdmp, Doc3038210381 (4).exe, 00000037.00000002.977043331.00000000024DA000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe	RDTSC instruction interceptor: First address: 00000000005A9904 second address: 00000000005A990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe	RDTSC instruction interceptor: First address: 00000000005A9B7E second address: 00000000005A9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe	RDTSC instruction interceptor: First address: 0000000002F99904 second address: 0000000002F9990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe	RDTSC instruction interceptor: First address: 0000000002F99B7E second address: 0000000002F99B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe TID: 5776	Thread sleep time: -39435s >= -30000s			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe TID: 6916	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe TID: 1072	Thread sleep time: -36777s >= -30000s
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe TID: 6300	Thread sleep time: -922337203685477s >= -30000s

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

Code function: 44_2_00409AB0 rdtsc

44_2_00409AB0

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Thread delayed: delay time: 922337203685477

Found large amount of non-executed APIs

Source: C:\Windows\SysWOW64\control.exe

API coverage: 5.2 %

Queries a list of all running processes

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

Process information queried: ProcessInformation

Jump to behavior

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Thread delayed: delay time: 39435			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Thread delayed: delay time: 36777
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Thread delayed: delay time: 922337203685477

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Doc3038210381 (4).exe, 00000037.00000002.977043331.00000000024DA000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 0000002D.00000000.913382241.000000000FD66000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}AutoIt3,,
Source: Doc3038210381 (4).exe, 00000037.00000002.977043331.00000000024DA000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000002D.00000000.950915584.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Doc3038210381 (4).exe, 00000037.00000002.977043331.00000000024DA000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 0000002D.00000000.907082019.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000002D.00000000.950915584.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000002D.00000000.944479447.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 0000002D.00000000.935683110.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 0000002D.00000000.935683110.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: Doc3038210381 (4).exe, 00000037.00000002.977043331.00000000024DA000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

Code function: 44_2_00409AB0 rdtsc

44_2_00409AB0

Enables debug privileges

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process token adjusted: Debug

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D746D mov eax, dword ptr fs:[00000030h]		56_2_047D746D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EA44B mov eax, dword ptr fs:[00000030h]		56_2_047EA44B
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EBC2C mov eax, dword ptr fs:[00000030h]		56_2_047EBC2C
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04888CD6 mov eax, dword ptr fs:[00000030h]		56_2_04888CD6
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836CF0 mov eax, dword ptr fs:[00000030h]		56_2_04836CF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836CF0 mov eax, dword ptr fs:[00000030h]		56_2_04836CF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836CF0 mov eax, dword ptr fs:[00000030h]		56_2_04836CF0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048714FB mov eax, dword ptr fs:[00000030h]		56_2_048714FB
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871C06 mov eax, dword ptr fs:[00000030h]		56_2_04871C06
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0488740D mov eax, dword ptr fs:[00000030h]		56_2_0488740D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0488740D mov eax, dword ptr fs:[00000030h]		56_2_0488740D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0488740D mov eax, dword ptr fs:[00000030h]		56_2_0488740D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836C0A mov eax, dword ptr fs:[00000030h]		56_2_04836C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836C0A mov eax, dword ptr fs:[00000030h]		56_2_04836C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836C0A mov eax, dword ptr fs:[00000030h]		56_2_04836C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836C0A mov eax, dword ptr fs:[00000030h]		56_2_04836C0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484C450 mov eax, dword ptr fs:[00000030h]		56_2_0484C450
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484C450 mov eax, dword ptr fs:[00000030h]		56_2_0484C450
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C849B mov eax, dword ptr fs:[00000030h]		56_2_047C849B
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DC577 mov eax, dword ptr fs:[00000030h]		56_2_047DC577
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DC577 mov eax, dword ptr fs:[00000030h]		56_2_047DC577
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048805AC mov eax, dword ptr fs:[00000030h]		56_2_048805AC
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048805AC mov eax, dword ptr fs:[00000030h]		56_2_048805AC
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D7D50 mov eax, dword ptr fs:[00000030h]		56_2_047D7D50
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F3D43 mov eax, dword ptr fs:[00000030h]		56_2_047F3D43
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E4D3B mov eax, dword ptr fs:[00000030h]		56_2_047E4D3B
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E4D3B mov eax, dword ptr fs:[00000030h]		56_2_047E4D3B
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E4D3B mov eax, dword ptr fs:[00000030h]		56_2_047E4D3B
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C3D34 mov eax, dword ptr fs:[00000030h]		56_2_047C3D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836DC9 mov eax, dword ptr fs:[00000030h]		56_2_04836DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836DC9 mov eax, dword ptr fs:[00000030h]		56_2_04836DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836DC9 mov eax, dword ptr fs:[00000030h]		56_2_04836DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836DC9 mov ecx, dword ptr fs:[00000030h]		56_2_04836DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836DC9 mov eax, dword ptr fs:[00000030h]		56_2_04836DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04836DC9 mov eax, dword ptr fs:[00000030h]		56_2_04836DC9
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BAD30 mov eax, dword ptr fs:[00000030h]		56_2_047BAD30
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487FDE2 mov eax, dword ptr fs:[00000030h]		56_2_0487FDE2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487FDE2 mov eax, dword ptr fs:[00000030h]		56_2_0487FDE2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487FDE2 mov eax, dword ptr fs:[00000030h]		56_2_0487FDE2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487FDE2 mov eax, dword ptr fs:[00000030h]		56_2_0487FDE2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04868DF1 mov eax, dword ptr fs:[00000030h]		56_2_04868DF1
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CD5E0 mov eax, dword ptr fs:[00000030h]		56_2_047CD5E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CD5E0 mov eax, dword ptr fs:[00000030h]		56_2_047CD5E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0483A537 mov eax, dword ptr fs:[00000030h]		56_2_0483A537
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04888D34 mov eax, dword ptr fs:[00000030h]		56_2_04888D34
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487E539 mov eax, dword ptr fs:[00000030h]		56_2_0487E539
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04833540 mov eax, dword ptr fs:[00000030h]		56_2_04833540
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04863D40 mov eax, dword ptr fs:[00000030h]		56_2_04863D40
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E1DB5 mov eax, dword ptr fs:[00000030h]		56_2_047E1DB5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E1DB5 mov eax, dword ptr fs:[00000030h]		56_2_047E1DB5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E1DB5 mov eax, dword ptr fs:[00000030h]		56_2_047E1DB5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E35A1 mov eax, dword ptr fs:[00000030h]		56_2_047E35A1
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EFD9B mov eax, dword ptr fs:[00000030h]		56_2_047EFD9B
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EFD9B mov eax, dword ptr fs:[00000030h]		56_2_047EFD9B
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B2D8A mov eax, dword ptr fs:[00000030h]		56_2_047B2D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B2D8A mov eax, dword ptr fs:[00000030h]		56_2_047B2D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B2D8A mov eax, dword ptr fs:[00000030h]		56_2_047B2D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B2D8A mov eax, dword ptr fs:[00000030h]		56_2_047B2D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B2D8A mov eax, dword ptr fs:[00000030h]		56_2_047B2D8A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E2581 mov eax, dword ptr fs:[00000030h]		56_2_047E2581
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E2581 mov eax, dword ptr fs:[00000030h]		56_2_047E2581
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E2581 mov eax, dword ptr fs:[00000030h]		56_2_047E2581
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E2581 mov eax, dword ptr fs:[00000030h]		56_2_047E2581
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484FE87 mov eax, dword ptr fs:[00000030h]		56_2_0484FE87
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DAE73 mov eax, dword ptr fs:[00000030h]		56_2_047DAE73
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DAE73 mov eax, dword ptr fs:[00000030h]		56_2_047DAE73
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DAE73 mov eax, dword ptr fs:[00000030h]		56_2_047DAE73
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DAE73 mov eax, dword ptr fs:[00000030h]		56_2_047DAE73
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DAE73 mov eax, dword ptr fs:[00000030h]		56_2_047DAE73
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C766D mov eax, dword ptr fs:[00000030h]		56_2_047C766D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048346A7 mov eax, dword ptr fs:[00000030h]		56_2_048346A7
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04880EA5 mov eax, dword ptr fs:[00000030h]		56_2_04880EA5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04880EA5 mov eax, dword ptr fs:[00000030h]		56_2_04880EA5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04880EA5 mov eax, dword ptr fs:[00000030h]		56_2_04880EA5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C7E41 mov eax, dword ptr fs:[00000030h]		56_2_047C7E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C7E41 mov eax, dword ptr fs:[00000030h]		56_2_047C7E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C7E41 mov eax, dword ptr fs:[00000030h]		56_2_047C7E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C7E41 mov eax, dword ptr fs:[00000030h]		56_2_047C7E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C7E41 mov eax, dword ptr fs:[00000030h]		56_2_047C7E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C7E41 mov eax, dword ptr fs:[00000030h]		56_2_047C7E41
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0486FEC0 mov eax, dword ptr fs:[00000030h]		56_2_0486FEC0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BE620 mov eax, dword ptr fs:[00000030h]		56_2_047BE620
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04888ED6 mov eax, dword ptr fs:[00000030h]		56_2_04888ED6
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EA61C mov eax, dword ptr fs:[00000030h]		56_2_047EA61C
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EA61C mov eax, dword ptr fs:[00000030h]		56_2_047EA61C
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BC600 mov eax, dword ptr fs:[00000030h]		56_2_047BC600
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BC600 mov eax, dword ptr fs:[00000030h]		56_2_047BC600
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BC600 mov eax, dword ptr fs:[00000030h]		56_2_047BC600
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E8E00 mov eax, dword ptr fs:[00000030h]		56_2_047E8E00
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04871608 mov eax, dword ptr fs:[00000030h]		56_2_04871608
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E16E0 mov ecx, dword ptr fs:[00000030h]		56_2_047E16E0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C76E2 mov eax, dword ptr fs:[00000030h]		56_2_047C76E2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E36CC mov eax, dword ptr fs:[00000030h]		56_2_047E36CC
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F8EC7 mov eax, dword ptr fs:[00000030h]		56_2_047F8EC7
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0486FE3F mov eax, dword ptr fs:[00000030h]		56_2_0486FE3F
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487AE44 mov eax, dword ptr fs:[00000030h]		56_2_0487AE44
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487AE44 mov eax, dword ptr fs:[00000030h]		56_2_0487AE44
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04837794 mov eax, dword ptr fs:[00000030h]		56_2_04837794
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04837794 mov eax, dword ptr fs:[00000030h]		56_2_04837794
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04837794 mov eax, dword ptr fs:[00000030h]		56_2_04837794
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CFF60 mov eax, dword ptr fs:[00000030h]		56_2_047CFF60
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CEF40 mov eax, dword ptr fs:[00000030h]		56_2_047CEF40
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DB73D mov eax, dword ptr fs:[00000030h]		56_2_047DB73D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DB73D mov eax, dword ptr fs:[00000030h]		56_2_047DB73D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EE730 mov eax, dword ptr fs:[00000030h]		56_2_047EE730
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B4F2E mov eax, dword ptr fs:[00000030h]		56_2_047B4F2E
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B4F2E mov eax, dword ptr fs:[00000030h]		56_2_047B4F2E
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DF716 mov eax, dword ptr fs:[00000030h]		56_2_047DF716
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EA70E mov eax, dword ptr fs:[00000030h]		56_2_047EA70E
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EA70E mov eax, dword ptr fs:[00000030h]		56_2_047EA70E
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0488070D mov eax, dword ptr fs:[00000030h]		56_2_0488070D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0488070D mov eax, dword ptr fs:[00000030h]		56_2_0488070D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F37F5 mov eax, dword ptr fs:[00000030h]		56_2_047F37F5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484FF10 mov eax, dword ptr fs:[00000030h]		56_2_0484FF10
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484FF10 mov eax, dword ptr fs:[00000030h]		56_2_0484FF10
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04888F6A mov eax, dword ptr fs:[00000030h]		56_2_04888F6A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C8794 mov eax, dword ptr fs:[00000030h]		56_2_047C8794
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04833884 mov eax, dword ptr fs:[00000030h]		56_2_04833884
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04833884 mov eax, dword ptr fs:[00000030h]		56_2_04833884
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D0050 mov eax, dword ptr fs:[00000030h]		56_2_047D0050
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D0050 mov eax, dword ptr fs:[00000030h]		56_2_047D0050
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA830 mov eax, dword ptr fs:[00000030h]		56_2_047DA830
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA830 mov eax, dword ptr fs:[00000030h]		56_2_047DA830
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA830 mov eax, dword ptr fs:[00000030h]		56_2_047DA830
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA830 mov eax, dword ptr fs:[00000030h]		56_2_047DA830
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E002D mov eax, dword ptr fs:[00000030h]		56_2_047E002D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E002D mov eax, dword ptr fs:[00000030h]		56_2_047E002D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E002D mov eax, dword ptr fs:[00000030h]		56_2_047E002D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E002D mov eax, dword ptr fs:[00000030h]		56_2_047E002D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E002D mov eax, dword ptr fs:[00000030h]		56_2_047E002D
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484B8D0 mov eax, dword ptr fs:[00000030h]		56_2_0484B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484B8D0 mov ecx, dword ptr fs:[00000030h]		56_2_0484B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484B8D0 mov eax, dword ptr fs:[00000030h]		56_2_0484B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484B8D0 mov eax, dword ptr fs:[00000030h]		56_2_0484B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484B8D0 mov eax, dword ptr fs:[00000030h]		56_2_0484B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0484B8D0 mov eax, dword ptr fs:[00000030h]		56_2_0484B8D0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CB02A mov eax, dword ptr fs:[00000030h]		56_2_047CB02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CB02A mov eax, dword ptr fs:[00000030h]		56_2_047CB02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CB02A mov eax, dword ptr fs:[00000030h]		56_2_047CB02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CB02A mov eax, dword ptr fs:[00000030h]		56_2_047CB02A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04837016 mov eax, dword ptr fs:[00000030h]		56_2_04837016
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04837016 mov eax, dword ptr fs:[00000030h]		56_2_04837016
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04837016 mov eax, dword ptr fs:[00000030h]		56_2_04837016
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B58EC mov eax, dword ptr fs:[00000030h]		56_2_047B58EC
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DB8E4 mov eax, dword ptr fs:[00000030h]		56_2_047DB8E4
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DB8E4 mov eax, dword ptr fs:[00000030h]		56_2_047DB8E4
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B40E1 mov eax, dword ptr fs:[00000030h]		56_2_047B40E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B40E1 mov eax, dword ptr fs:[00000030h]		56_2_047B40E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B40E1 mov eax, dword ptr fs:[00000030h]		56_2_047B40E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04884015 mov eax, dword ptr fs:[00000030h]		56_2_04884015
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04884015 mov eax, dword ptr fs:[00000030h]		56_2_04884015
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EF0BF mov ecx, dword ptr fs:[00000030h]		56_2_047EF0BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EF0BF mov eax, dword ptr fs:[00000030h]		56_2_047EF0BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EF0BF mov eax, dword ptr fs:[00000030h]		56_2_047EF0BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F90AF mov eax, dword ptr fs:[00000030h]		56_2_047F90AF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E20A0 mov eax, dword ptr fs:[00000030h]		56_2_047E20A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E20A0 mov eax, dword ptr fs:[00000030h]		56_2_047E20A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E20A0 mov eax, dword ptr fs:[00000030h]		56_2_047E20A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E20A0 mov eax, dword ptr fs:[00000030h]		56_2_047E20A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E20A0 mov eax, dword ptr fs:[00000030h]		56_2_047E20A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E20A0 mov eax, dword ptr fs:[00000030h]		56_2_047E20A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04872073 mov eax, dword ptr fs:[00000030h]		56_2_04872073
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B9080 mov eax, dword ptr fs:[00000030h]		56_2_047B9080
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04881074 mov eax, dword ptr fs:[00000030h]		56_2_04881074
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BB171 mov eax, dword ptr fs:[00000030h]		56_2_047BB171
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BB171 mov eax, dword ptr fs:[00000030h]		56_2_047BB171
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BC962 mov eax, dword ptr fs:[00000030h]		56_2_047BC962
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048749A4 mov eax, dword ptr fs:[00000030h]		56_2_048749A4
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048749A4 mov eax, dword ptr fs:[00000030h]		56_2_048749A4
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048749A4 mov eax, dword ptr fs:[00000030h]		56_2_048749A4
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048749A4 mov eax, dword ptr fs:[00000030h]		56_2_048749A4
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048369A6 mov eax, dword ptr fs:[00000030h]		56_2_048369A6
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DB944 mov eax, dword ptr fs:[00000030h]		56_2_047DB944
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DB944 mov eax, dword ptr fs:[00000030h]		56_2_047DB944
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048351BE mov eax, dword ptr fs:[00000030h]		56_2_048351BE
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048351BE mov eax, dword ptr fs:[00000030h]		56_2_048351BE
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048351BE mov eax, dword ptr fs:[00000030h]		56_2_048351BE
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048351BE mov eax, dword ptr fs:[00000030h]		56_2_048351BE
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E513A mov eax, dword ptr fs:[00000030h]		56_2_047E513A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E513A mov eax, dword ptr fs:[00000030h]		56_2_047E513A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D4120 mov eax, dword ptr fs:[00000030h]		56_2_047D4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D4120 mov eax, dword ptr fs:[00000030h]		56_2_047D4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D4120 mov eax, dword ptr fs:[00000030h]		56_2_047D4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D4120 mov eax, dword ptr fs:[00000030h]		56_2_047D4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D4120 mov ecx, dword ptr fs:[00000030h]		56_2_047D4120
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048441E8 mov eax, dword ptr fs:[00000030h]		56_2_048441E8
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B9100 mov eax, dword ptr fs:[00000030h]		56_2_047B9100
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B9100 mov eax, dword ptr fs:[00000030h]		56_2_047B9100
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B9100 mov eax, dword ptr fs:[00000030h]		56_2_047B9100
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BB1E1 mov eax, dword ptr fs:[00000030h]		56_2_047BB1E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BB1E1 mov eax, dword ptr fs:[00000030h]		56_2_047BB1E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BB1E1 mov eax, dword ptr fs:[00000030h]		56_2_047BB1E1
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov ecx, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov ecx, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov eax, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov ecx, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov ecx, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov eax, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov ecx, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov ecx, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov eax, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov ecx, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov ecx, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D99BF mov eax, dword ptr fs:[00000030h]		56_2_047D99BF
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E61A0 mov eax, dword ptr fs:[00000030h]		56_2_047E61A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E61A0 mov eax, dword ptr fs:[00000030h]		56_2_047E61A0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E2990 mov eax, dword ptr fs:[00000030h]		56_2_047E2990
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EA185 mov eax, dword ptr fs:[00000030h]		56_2_047EA185
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DC182 mov eax, dword ptr fs:[00000030h]		56_2_047DC182
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F927A mov eax, dword ptr fs:[00000030h]		56_2_047F927A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B9240 mov eax, dword ptr fs:[00000030h]		56_2_047B9240
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B9240 mov eax, dword ptr fs:[00000030h]		56_2_047B9240
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B9240 mov eax, dword ptr fs:[00000030h]		56_2_047B9240
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B9240 mov eax, dword ptr fs:[00000030h]		56_2_047B9240
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F4A2C mov eax, dword ptr fs:[00000030h]		56_2_047F4A2C
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047F4A2C mov eax, dword ptr fs:[00000030h]		56_2_047F4A2C
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA229 mov eax, dword ptr fs:[00000030h]		56_2_047DA229
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA229 mov eax, dword ptr fs:[00000030h]		56_2_047DA229
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA229 mov eax, dword ptr fs:[00000030h]		56_2_047DA229
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA229 mov eax, dword ptr fs:[00000030h]		56_2_047DA229
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA229 mov eax, dword ptr fs:[00000030h]		56_2_047DA229
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA229 mov eax, dword ptr fs:[00000030h]		56_2_047DA229
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA229 mov eax, dword ptr fs:[00000030h]		56_2_047DA229
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA229 mov eax, dword ptr fs:[00000030h]		56_2_047DA229
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DA229 mov eax, dword ptr fs:[00000030h]		56_2_047DA229
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047D3A1C mov eax, dword ptr fs:[00000030h]		56_2_047D3A1C
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B5210 mov eax, dword ptr fs:[00000030h]		56_2_047B5210
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B5210 mov ecx, dword ptr fs:[00000030h]		56_2_047B5210
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B5210 mov eax, dword ptr fs:[00000030h]		56_2_047B5210
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B5210 mov eax, dword ptr fs:[00000030h]		56_2_047B5210
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BAA16 mov eax, dword ptr fs:[00000030h]		56_2_047BAA16
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BAA16 mov eax, dword ptr fs:[00000030h]		56_2_047BAA16
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C8A0A mov eax, dword ptr fs:[00000030h]		56_2_047C8A0A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487AA16 mov eax, dword ptr fs:[00000030h]		56_2_0487AA16
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487AA16 mov eax, dword ptr fs:[00000030h]		56_2_0487AA16
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E2AE4 mov eax, dword ptr fs:[00000030h]		56_2_047E2AE4
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E2ACB mov eax, dword ptr fs:[00000030h]		56_2_047E2ACB
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CAAB0 mov eax, dword ptr fs:[00000030h]		56_2_047CAAB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047CAAB0 mov eax, dword ptr fs:[00000030h]		56_2_047CAAB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EFAB0 mov eax, dword ptr fs:[00000030h]		56_2_047EFAB0
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487EA55 mov eax, dword ptr fs:[00000030h]		56_2_0487EA55
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04844257 mov eax, dword ptr fs:[00000030h]		56_2_04844257
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B52A5 mov eax, dword ptr fs:[00000030h]		56_2_047B52A5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B52A5 mov eax, dword ptr fs:[00000030h]		56_2_047B52A5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B52A5 mov eax, dword ptr fs:[00000030h]		56_2_047B52A5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B52A5 mov eax, dword ptr fs:[00000030h]		56_2_047B52A5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047B52A5 mov eax, dword ptr fs:[00000030h]		56_2_047B52A5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0486B260 mov eax, dword ptr fs:[00000030h]		56_2_0486B260
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0486B260 mov eax, dword ptr fs:[00000030h]		56_2_0486B260
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047ED294 mov eax, dword ptr fs:[00000030h]		56_2_047ED294
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047ED294 mov eax, dword ptr fs:[00000030h]		56_2_047ED294
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04888A62 mov eax, dword ptr fs:[00000030h]		56_2_04888A62
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E3B7A mov eax, dword ptr fs:[00000030h]		56_2_047E3B7A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E3B7A mov eax, dword ptr fs:[00000030h]		56_2_047E3B7A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0486D380 mov ecx, dword ptr fs:[00000030h]		56_2_0486D380
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487138A mov eax, dword ptr fs:[00000030h]		56_2_0487138A
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BDB60 mov ecx, dword ptr fs:[00000030h]		56_2_047BDB60
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BF358 mov eax, dword ptr fs:[00000030h]		56_2_047BF358
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04885BA5 mov eax, dword ptr fs:[00000030h]		56_2_04885BA5
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047BDB40 mov eax, dword ptr fs:[00000030h]		56_2_047BDB40
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048353CA mov eax, dword ptr fs:[00000030h]		56_2_048353CA
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_048353CA mov eax, dword ptr fs:[00000030h]		56_2_048353CA
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047DDBE9 mov eax, dword ptr fs:[00000030h]		56_2_047DDBE9
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_0487131B mov eax, dword ptr fs:[00000030h]		56_2_0487131B
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E03E2 mov eax, dword ptr fs:[00000030h]		56_2_047E03E2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E03E2 mov eax, dword ptr fs:[00000030h]		56_2_047E03E2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E03E2 mov eax, dword ptr fs:[00000030h]		56_2_047E03E2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E03E2 mov eax, dword ptr fs:[00000030h]		56_2_047E03E2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E03E2 mov eax, dword ptr fs:[00000030h]		56_2_047E03E2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E03E2 mov eax, dword ptr fs:[00000030h]		56_2_047E03E2
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_04888B58 mov eax, dword ptr fs:[00000030h]		56_2_04888B58
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E4BAD mov eax, dword ptr fs:[00000030h]		56_2_047E4BAD
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E4BAD mov eax, dword ptr fs:[00000030h]		56_2_047E4BAD
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E4BAD mov eax, dword ptr fs:[00000030h]		56_2_047E4BAD
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047E2397 mov eax, dword ptr fs:[00000030h]		56_2_047E2397
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047EB390 mov eax, dword ptr fs:[00000030h]		56_2_047EB390
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C1B8F mov eax, dword ptr fs:[00000030h]		56_2_047C1B8F
Source: C:\Windows\SysWOW64\control.exe	Code function: 56_2_047C1B8F mov eax, dword ptr fs:[00000030h]		56_2_047C1B8F

Checks if the current process is being debugged

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\control.exe	Process queried: DebugPort

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

Code function: 44_2_0040ACF0 LdrLoadDll,

44_2_0040ACF0

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Sample uses process hollowing technique

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

Section unmapped: C:\Windows\SysWOW64\control.exe base address: 940000

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Memory written: C:\Users\user\Downloads\Doc3038210381 (2).exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Memory written: C:\Users\user\Downloads\Doc3038210381 (4).exe base: 400000 value starts with: 4D5A

Queues an APC in another process (thread injection)

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

Thread register set: target process: 3424

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process created: C:\Users\user\Downloads\Doc3038210381 (2).exe C:\Users\user\Downloads\Doc3038210381 (2).exe			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Process created: C:\Users\user\Downloads\Doc3038210381 (2).exe C:\Users\user\Downloads\Doc3038210381 (2).exe			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Process created: C:\Users\user\Downloads\Doc3038210381 (4).exe C:\Users\user\Downloads\Doc3038210381 (4).exe
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Downloads\Doc3038210381 (2).exe"

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 0000002D.00000000.977346948.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 0000002D.00000000.925752175.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 0000002D.00000000.901629474.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 0000002D.00000000.942845309.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 0000002D.00000000.977776936.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.943242970.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.926111733.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.902109091.0000000001080000.00000002.00020000.sdmp, control.exe, 00000038.00000002.1068412407.0000000003040000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000002D.00000000.946310755.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 0000002D.00000000.977776936.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.943242970.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.926111733.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.902109091.0000000001080000.00000002.00020000.sdmp, control.exe, 00000038.00000002.1068412407.0000000003040000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000002D.00000000.977776936.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.943242970.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.926111733.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.902109091.0000000001080000.00000002.00020000.sdmp, control.exe, 00000038.00000002.1068412407.0000000003040000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000002D.00000000.977776936.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.943242970.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.926111733.0000000001080000.00000002.00020000.sdmp, explorer.exe, 0000002D.00000000.902109091.0000000001080000.00000002.00020000.sdmp, control.exe, 00000038.00000002.1068412407.0000000003040000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000002D.00000000.951067661.000000000A716000.00000004.00000001.sdmp, explorer.exe, 0000002D.00000000.911268027.000000000A716000.00000004.00000001.sdmp, explorer.exe, 0000002D.00000000.935683110.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Users\user\Downloads\Doc3038210381 (2).exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Queries volume information: C:\Users\user\Downloads\Doc3038210381 (4).exe VolumeInformation
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Downloads\Doc3038210381 (4).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation

Queries the cryptographic machine GUID

Source: C:\Users\user\Downloads\Doc3038210381 (2).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 44.2.Doc3038210381 (2).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.Doc3038210381 (2).exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000038.00000002.1067590564.0000000002960000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000000.896879131.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.1066540925.00000000005A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.1067661415.0000000002990000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.971832509.00000000010E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.947225633.000000000691F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.977919600.0000000003499000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.932775255.000000000691F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1012428415.0000000000E90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000000.972238281.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1012381987.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.903704125.0000000003419000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003D.00000002.1018113632.0000000002F90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000000.897454955.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.971108516.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.972028114.00000000014F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000000.971453984.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1011928391.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 44.2.Doc3038210381 (2).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.0.Doc3038210381 (2).exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.Doc3038210381 (2).exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000038.00000002.1067590564.0000000002960000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000000.896879131.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.1066540925.00000000005A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.1067661415.0000000002990000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.971832509.00000000010E0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.947225633.000000000691F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.977919600.0000000003499000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.932775255.000000000691F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1012428415.0000000000E90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000000.972238281.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1012381987.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.903704125.0000000003419000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003D.00000002.1018113632.0000000002F90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000000.897454955.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.971108516.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.972028114.00000000014F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000000.971453984.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000039.00000002.1011928391.0000000000400000.00000040.00000001.sdmp, type: MEMORY