Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe
Analysis ID: 1417468
MD5: e93f05a032c2dcc01bb1f343582ff152
SHA1: c297eca7f4c4e5bdbd6c3afe2a93fb3fb8429888
SHA256: 540ee02cde457f4389894abe69d9ae02aa4dbb9b2d7d04df5adf9af6b1b8a5ce
Tags: exeFormbook
Infos:

Detection

FormBook, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe ReversingLabs: Detection: 42%
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Virustotal: Detection: 43% Perma Link
Yara detected FormBook
Source: Yara match File source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.2226854147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Machine Learning detection for sample
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000006.00000002.2227150345.0000000001560000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000006.00000002.2227150345.0000000001560000.00000040.00001000.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 4x nop then jmp 0760F0CBh 0_2_0760E6C3
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000000.00000002.2061019851.00000000033AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.9.dr String found in binary or memory: http://upx.sf.net

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.2226854147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2226854147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0040B0E3 NtCreateFile, 6_2_0040B0E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0040B313 NtReadFile, 6_2_0040B313
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0040BBA3 NtAllocateVirtualMemory, 6_2_0040BBA3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0042BF33 NtClose, 6_2_0042BF33
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2DF0 NtQuerySystemInformation,LdrInitializeThunk, 6_2_015D2DF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D4340 NtSetContextThread, 6_2_015D4340
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D4650 NtSuspendThread, 6_2_015D4650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2B60 NtClose, 6_2_015D2B60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2BF0 NtAllocateVirtualMemory, 6_2_015D2BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2BE0 NtQueryValueKey, 6_2_015D2BE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2B80 NtQueryInformationFile, 6_2_015D2B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2BA0 NtEnumerateValueKey, 6_2_015D2BA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2AD0 NtReadFile, 6_2_015D2AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2AF0 NtWriteFile, 6_2_015D2AF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2AB0 NtWaitForSingleObject, 6_2_015D2AB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2D10 NtMapViewOfSection, 6_2_015D2D10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2D00 NtSetInformationFile, 6_2_015D2D00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2D30 NtUnmapViewOfSection, 6_2_015D2D30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2DD0 NtDelayExecution, 6_2_015D2DD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2DB0 NtEnumerateKey, 6_2_015D2DB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2C70 NtFreeVirtualMemory, 6_2_015D2C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2C60 NtCreateKey, 6_2_015D2C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2C00 NtQueryInformationProcess, 6_2_015D2C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2CC0 NtQueryVirtualMemory, 6_2_015D2CC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2CF0 NtOpenProcess, 6_2_015D2CF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2CA0 NtQueryInformationToken, 6_2_015D2CA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2F60 NtCreateProcessEx, 6_2_015D2F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2F30 NtCreateSection, 6_2_015D2F30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2FE0 NtCreateFile, 6_2_015D2FE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2F90 NtProtectVirtualMemory, 6_2_015D2F90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2FB0 NtResumeThread, 6_2_015D2FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2FA0 NtQuerySection, 6_2_015D2FA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2E30 NtWriteVirtualMemory, 6_2_015D2E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2EE0 NtQueueApcThread, 6_2_015D2EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2E80 NtReadVirtualMemory, 6_2_015D2E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2EA0 NtAdjustPrivilegesToken, 6_2_015D2EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D3010 NtOpenDirectoryObject, 6_2_015D3010
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D3090 NtSetValueKey, 6_2_015D3090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D35C0 NtCreateMutant, 6_2_015D35C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D39B0 NtGetContextThread, 6_2_015D39B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D3D70 NtOpenThread, 6_2_015D3D70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D3D10 NtOpenProcessToken, 6_2_015D3D10
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_01724AE0 0_2_01724AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_0172D64C 0_2_0172D64C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_0760D628 0_2_0760D628
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_0760E4B8 0_2_0760E4B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_07603320 0_2_07603320
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_07609720 0_2_07609720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_0760D619 0_2_0760D619
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_0760D5E0 0_2_0760D5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_07603310 0_2_07603310
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_0760A3C8 0_2_0760A3C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_0760A3B8 0_2_0760A3B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_0760C140 0_2_0760C140
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_07602158 0_2_07602158
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_0760C130 0_2_0760C130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_07609F81 0_2_07609F81
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_07609F90 0_2_07609F90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_07601B47 0_2_07601B47
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_07601B58 0_2_07601B58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_07609B58 0_2_07609B58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 0_2_0B420040 0_2_0B420040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004028A0 6_2_004028A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004011D0 6_2_004011D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0042E2D3 6_2_0042E2D3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00417B23 6_2_00417B23
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004113C3 6_2_004113C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004113BC 6_2_004113BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004115E3 6_2_004115E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004025B0 6_2_004025B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0040F65B 6_2_0040F65B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0040F663 6_2_0040F663
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00402FA0 6_2_00402FA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01628158 6_2_01628158
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01590100 6_2_01590100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163A118 6_2_0163A118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016581CC 6_2_016581CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016541A2 6_2_016541A2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016601AA 6_2_016601AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01632000 6_2_01632000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165A352 6_2_0165A352
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016603E6 6_2_016603E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AE3F0 6_2_015AE3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016202C0 6_2_016202C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0535 6_2_015A0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01660591 6_2_01660591
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01652446 6_2_01652446
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01644420 6_2_01644420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0164E4F6 6_2_0164E4F6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C4750 6_2_015C4750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159C7C0 6_2_0159C7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BC6E0 6_2_015BC6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B6962 6_2_015B6962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0166A9A6 6_2_0166A9A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A2840 6_2_015A2840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AA840 6_2_015AA840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE8F0 6_2_015CE8F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015868B8 6_2_015868B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165AB40 6_2_0165AB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01656BD7 6_2_01656BD7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159EA80 6_2_0159EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AAD00 6_2_015AAD00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163CD1F 6_2_0163CD1F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159ADE0 6_2_0159ADE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B8DBF 6_2_015B8DBF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0C00 6_2_015A0C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01590CF2 6_2_01590CF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640CB5 6_2_01640CB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01614F40 6_2_01614F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01642F30 6_2_01642F30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C0F30 6_2_015C0F30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015E2F28 6_2_015E2F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01592FC8 6_2_01592FC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015ACFE0 6_2_015ACFE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161EFA0 6_2_0161EFA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0E59 6_2_015A0E59
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165EE26 6_2_0165EE26
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165EEDB 6_2_0165EEDB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B2E90 6_2_015B2E90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165CE93 6_2_0165CE93
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0166B16B 6_2_0166B16B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158F172 6_2_0158F172
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D516C 6_2_015D516C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AB1B0 6_2_015AB1B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165F0E0 6_2_0165F0E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016570E9 6_2_016570E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A70C0 6_2_015A70C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0164F0CC 6_2_0164F0CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158D34C 6_2_0158D34C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165132D 6_2_0165132D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015E739A 6_2_015E739A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016412ED 6_2_016412ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BB2C0 6_2_015BB2C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A52A0 6_2_015A52A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01657571 6_2_01657571
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016695C3 6_2_016695C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163D5B0 6_2_0163D5B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01591460 6_2_01591460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165F43F 6_2_0165F43F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165F7B0 6_2_0165F7B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015E5630 6_2_015E5630
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016516CC 6_2_016516CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A9950 6_2_015A9950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BB950 6_2_015BB950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01635910 6_2_01635910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160D800 6_2_0160D800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A38E0 6_2_015A38E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165FB76 6_2_0165FB76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01615BF0 6_2_01615BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015DDBF9 6_2_015DDBF9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BFB80 6_2_015BFB80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01613A6C 6_2_01613A6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01657A46 6_2_01657A46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165FA49 6_2_0165FA49
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0164DAC6 6_2_0164DAC6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01641AA3 6_2_01641AA3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163DAAC 6_2_0163DAAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015E5AA0 6_2_015E5AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01657D73 6_2_01657D73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A3D40 6_2_015A3D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01651D5A 6_2_01651D5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BFDC0 6_2_015BFDC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01619C32 6_2_01619C32
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165FCF2 6_2_0165FCF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165FF09 6_2_0165FF09
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01563FD5 6_2_01563FD5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01563FD2 6_2_01563FD2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A1F92 6_2_015A1F92
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165FFB1 6_2_0165FFB1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A9EB0 6_2_015A9EB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: String function: 0158B970 appears 280 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: String function: 015E7E54 appears 111 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: String function: 0161F290 appears 105 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: String function: 0160EA12 appears 86 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: String function: 015D5130 appears 58 times
One or more processes crash
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 200
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000000.00000002.2062816083.0000000004691000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000000.00000002.2059840140.000000000151E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000000.00000002.2066529545.0000000007FC0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000006.00000002.2227150345.000000000168D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Binary or memory string: OriginalFilenameqjyJ.exe" vs SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2226854147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, cVEO9CMJxhBxSwEjPo.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, cVEO9CMJxhBxSwEjPo.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, PF1OEmThlgvMLXYscu.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, PF1OEmThlgvMLXYscu.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, PF1OEmThlgvMLXYscu.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, PF1OEmThlgvMLXYscu.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, PF1OEmThlgvMLXYscu.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, PF1OEmThlgvMLXYscu.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.338bd58.0.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.75d0000.5.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.3383d40.1.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.troj.evad.winEXE@10/11@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess516
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2672:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Mutant created: \Sessions\1\BaseNamedObjects\YFgrdHHrBXAxYRtWpWJbATbodng
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzvvh4of.br4.ps1 Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe ReversingLabs: Detection: 42%
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Virustotal: Detection: 43%
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 200
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000006.00000002.2227150345.0000000001560000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000006.00000002.2227150345.0000000001560000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, MainWindow.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, PF1OEmThlgvMLXYscu.cs .Net Code: MrH3AMjeDj System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, PF1OEmThlgvMLXYscu.cs .Net Code: MrH3AMjeDj System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.raw.unpack, I1Ds3abkUA5mh3kywv.cs .Net Code: hyVW2X9uL System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.raw.unpack, I1Ds3abkUA5mh3kywv.cs .Net Code: hyVW2X9uL System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0041304E push cs; iretd 6_2_0041304F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004080F1 pushad ; retf 6_2_004080FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00413096 push ebp; ret 6_2_0041309C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004021CA push eax; iretd 6_2_00402234
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004191E6 push es; retf 6_2_004191E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004021A5 push eax; iretd 6_2_00402234
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00402235 push eax; iretd 6_2_00402234
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00402235 push edx; iretd 6_2_00402260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00419AF7 pushad ; iretd 6_2_00419B2A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00419AAB pushad ; iretd 6_2_00419B2A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_004032B0 push eax; ret 6_2_004032B2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00419B42 push ebp; retf 6_2_00419BE6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00419B2B pushad ; iretd 6_2_00419B2A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00419B2B push ebp; retf 6_2_00419BE6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0042F392 push eax; ret 6_2_0042F394
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0040244C push esi; retf 6_2_0040244F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00401E4D pushad ; ret 6_2_00401E5D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0040E6CD push esp; iretd 6_2_0040E6DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00419ED9 push FFFFFFD2h; iretd 6_2_00419EDB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0040CFEA push ebx; ret 6_2_0040CFEE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_00401FA4 pushad ; ret 6_2_00401FB7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0156225F pushad ; ret 6_2_015627F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015627FA pushad ; ret 6_2_015627F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015909AD push ecx; mov dword ptr [esp], ecx 6_2_015909B6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0156283D push eax; iretd 6_2_01562858
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0156135E push eax; iretd 6_2_01561369
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Static PE information: section name: .text entropy: 7.971619173108648
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, ciXg1rfx6175equuat.cs High entropy of concatenated method names: 'u5okSUMEIj', 'eeakeLV18f', 'VSPkAnc4cJ', 'ooSkjq0pWG', 'GBskQXdAZ6', 'M34kuqUT8e', 'eT5kFhRsEi', 'ANbkMggSRK', 'bhSkWpiABa', 'VqKkDeKb9a'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, bhWO0SCSMpQ4wDiO0C.cs High entropy of concatenated method names: 'iCpr9igRgy', 'fgYrLL1g2P', 'edFrll5iiP', 'ah3rkIxtOf', 'h0srT4yMIU', 'zr9lsieI8p', 'UmwlZfx1Bv', 'xh6lyckH43', 'WZmlxagm92', 'hEHlbntcbM'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, PF1OEmThlgvMLXYscu.cs High entropy of concatenated method names: 'nisw94O4mS', 'mcmwv8aZDt', 'LwQwLsBZsV', 'Oaww8R0xsj', 'uMMwle3HvI', 'qcXwrrbL1H', 't4fwkIDQ1H', 'WSIwTm7nLj', 'ny9w7ZamDM', 'u9bwBv8mV1'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, C99ed7bMfbfdkngYX3.cs High entropy of concatenated method names: 'UmwPCXNoqv', 'h4JPH443pK', 'fbTPhEDMaU', 'QPAPonLgmQ', 'aQWPJLa0fS', 'b5bPUUXYXL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, Saxsv93p6ooEMwLK7B.cs High entropy of concatenated method names: 'uUwKkVEO9C', 'QxhKTBxSwE', 'JEKKBvpIB1', 'REIKOIf2J1', 'jetKmHT4hW', 'm0SK2SMpQ4', 'cWeD0gjt3sHyTNTV8G', 'SWxm4ZPFJqkX2PkAan', 'bfiKK8qIqk', 'lEEKwUL7da'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, q7wTWpKNQ2qTEIVoN0j.cs High entropy of concatenated method names: 'PUsdS5NZ83', 'YThdeSRZrS', 'CckdARSc4F', 'XGSdjtPusx', 'mbLdQTgjeY', 'NTZduMkqod', 'ntVdFBPbXk', 'hT5dMErsEI', 'rBjdWnMOhj', 'c1NdDVukNu'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, NALfih1u06CltuhWRC.cs High entropy of concatenated method names: 'jfhkvVKhcG', 'nxWk8UAVUf', 'a35krCkmAA', 'hCrrcDOP1p', 'VFUrzWB7Ln', 'P8HkNnajLo', 'IrYkKHVP8m', 'XuXk449tOI', 'NjnkwQAhRq', 'vvBk3RjiGo'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, vX0QTO41kOdEW3YRaX.cs High entropy of concatenated method names: 'YP6AgJEjq', 'Ckujv3TCr', 'ivDuKD6nt', 'iFXFi8mlH', 'FmYWMdZfp', 'WPtDOEAX1', 'p0yTwZSh1edImPlqCK', 'VM7S5kFYIuivXkgi2O', 'wHCP1hgRe', 'uSrIwBxKc'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, M2J15fDNq2XCtketHT.cs High entropy of concatenated method names: 'EdplQ49Osy', 'MlZlFuSaiW', 'mY88hGst8Q', 'UEJ8odSpZd', 'Jpd8URH19q', 'i9J854lIcZ', 'RWG81DmnPX', 'W5v8YX60ZW', 'yVH8fpIFXA', 'IDx8nMBTI9'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, wMcB1sc0N2O3Ac93QD.cs High entropy of concatenated method names: 'x1qdKV2LId', 'C1ZdwZWuTM', 'RnDd3hrypM', 'XJUdv8JeGK', 'JJKdLaEsm9', 'KvYdliWm6h', 'JRydrCnMJ2', 'oKNPyjNIhk', 'aUaPxKZn6J', 'AawPbH9xF5'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, QJ4bK7idyGlgewBVjA.cs High entropy of concatenated method names: 'ToString', 'kkI2qahL4S', 'dn12H5giG4', 'QMV2hrB4W2', 'IiU2o2kIV5', 'igN2UGJgNV', 'P9m25lDuyd', 'vKo21rQZjf', 'm9O2YrKtGq', 'MoI2fECnNP'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, cVEO9CMJxhBxSwEjPo.cs High entropy of concatenated method names: 'cVdLJrKdNp', 'QqcL00I2Id', 'ApoLikfPkn', 'fraLa3Xowo', 'HIYLsQqpnx', 'uvWLZV6Xcq', 'UWeLyLCpox', 'NMeLxOPEks', 'LkQLbvLN22', 'gS5LcX9y7F'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, C0BRZ6JVXd9BYAaY0a.cs High entropy of concatenated method names: 'Ga3mnMXZ4j', 'DndmRmaXpL', 't1DmJ94Kb3', 'WC2m0C85PN', 'J1RmH1exqh', 'BrWmhKA2nx', 'qrHmodaLw9', 'bV8mU1OvMW', 'AeTm5Fq41x', 'mFLm1Y8yZn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, awDWTdxUvoQrQOmT8t.cs High entropy of concatenated method names: 'Ac3PvQlrKh', 'Ld2PLNM0pW', 'aOjP8usgSq', 'PqHPlbEcrY', 'UgCPrO0qFI', 'TnQPk7rLJs', 'nqaPTXRVU2', 'JV1P7NWabn', 'tCTPBxRQvX', 'rpCPOErrfM'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, k562qbLTwPvh456TJl.cs High entropy of concatenated method names: 'Dispose', 'wZAKbv7K6O', 'nPk4Hsocrp', 'MN4xxCuK01', 'QKwKcDWTdU', 'foQKzrQOmT', 'ProcessDialogKey', 'htF4N99ed7', 'Dfb4Kfdkng', 'LX344XMcB1'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, MW7AAtVb94AhtfioIn.cs High entropy of concatenated method names: 'BDo6MuyeFt', 'bN36WM10Mv', 'h9l6CBbnqf', 'jL96Hgch8w', 'zIL6oElU54', 'svH6UF5I68', 'ze461km61a', 'cwP6YsrIAN', 'UNM6n14VDR', 'WYW6q2QX6l'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, zYltydKwC9cU3MJwKap.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fsKIJdd99P', 'DNNI0iNsLf', 'oM3IiBjrus', 'F8EIa1vAQL', 'BnfIsxlC2R', 'QnQIZBOTWN', 'tevIyMllLg'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, SxssdYZRImfa3CdMNJ.cs High entropy of concatenated method names: 'jWapx7ivvs', 'Kq8pcwOwUN', 'CBjPNoukAD', 'tqtPKUoXPj', 'UJhpqcK4Uo', 'A6opRH9ALn', 'ToIpVbTKt8', 'FGjpJvsDjW', 'rY4p0grVi6', 'qRCpia3u7u'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, QfBJgfaaKLZGH9VJvl.cs High entropy of concatenated method names: 'O09pBHmISq', 'KnQpORDtX4', 'ToString', 'e6IpvSrnA3', 'L3wpLKCQny', 'z47p886pJH', 'x3aplBrqU8', 'LoMpr4SKEb', 'ovUpkopU5U', 'q7upTTRD9y'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.4747500.3.raw.unpack, C0xxRUWEKvpIB10EII.cs High entropy of concatenated method names: 'aRl8j5yEV0', 'lri8uVQdqI', 'mMR8MrVy1m', 'RUK8WpoGwn', 'otO8mSKd1l', 'rH182dGfKr', 's088pCQxTA', 'wp58PdOyn0', 'o6A8dItcNt', 'QCc8IB1Ych'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, ciXg1rfx6175equuat.cs High entropy of concatenated method names: 'u5okSUMEIj', 'eeakeLV18f', 'VSPkAnc4cJ', 'ooSkjq0pWG', 'GBskQXdAZ6', 'M34kuqUT8e', 'eT5kFhRsEi', 'ANbkMggSRK', 'bhSkWpiABa', 'VqKkDeKb9a'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, bhWO0SCSMpQ4wDiO0C.cs High entropy of concatenated method names: 'iCpr9igRgy', 'fgYrLL1g2P', 'edFrll5iiP', 'ah3rkIxtOf', 'h0srT4yMIU', 'zr9lsieI8p', 'UmwlZfx1Bv', 'xh6lyckH43', 'WZmlxagm92', 'hEHlbntcbM'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, PF1OEmThlgvMLXYscu.cs High entropy of concatenated method names: 'nisw94O4mS', 'mcmwv8aZDt', 'LwQwLsBZsV', 'Oaww8R0xsj', 'uMMwle3HvI', 'qcXwrrbL1H', 't4fwkIDQ1H', 'WSIwTm7nLj', 'ny9w7ZamDM', 'u9bwBv8mV1'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, C99ed7bMfbfdkngYX3.cs High entropy of concatenated method names: 'UmwPCXNoqv', 'h4JPH443pK', 'fbTPhEDMaU', 'QPAPonLgmQ', 'aQWPJLa0fS', 'b5bPUUXYXL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, Saxsv93p6ooEMwLK7B.cs High entropy of concatenated method names: 'uUwKkVEO9C', 'QxhKTBxSwE', 'JEKKBvpIB1', 'REIKOIf2J1', 'jetKmHT4hW', 'm0SK2SMpQ4', 'cWeD0gjt3sHyTNTV8G', 'SWxm4ZPFJqkX2PkAan', 'bfiKK8qIqk', 'lEEKwUL7da'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, q7wTWpKNQ2qTEIVoN0j.cs High entropy of concatenated method names: 'PUsdS5NZ83', 'YThdeSRZrS', 'CckdARSc4F', 'XGSdjtPusx', 'mbLdQTgjeY', 'NTZduMkqod', 'ntVdFBPbXk', 'hT5dMErsEI', 'rBjdWnMOhj', 'c1NdDVukNu'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, NALfih1u06CltuhWRC.cs High entropy of concatenated method names: 'jfhkvVKhcG', 'nxWk8UAVUf', 'a35krCkmAA', 'hCrrcDOP1p', 'VFUrzWB7Ln', 'P8HkNnajLo', 'IrYkKHVP8m', 'XuXk449tOI', 'NjnkwQAhRq', 'vvBk3RjiGo'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, vX0QTO41kOdEW3YRaX.cs High entropy of concatenated method names: 'YP6AgJEjq', 'Ckujv3TCr', 'ivDuKD6nt', 'iFXFi8mlH', 'FmYWMdZfp', 'WPtDOEAX1', 'p0yTwZSh1edImPlqCK', 'VM7S5kFYIuivXkgi2O', 'wHCP1hgRe', 'uSrIwBxKc'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, M2J15fDNq2XCtketHT.cs High entropy of concatenated method names: 'EdplQ49Osy', 'MlZlFuSaiW', 'mY88hGst8Q', 'UEJ8odSpZd', 'Jpd8URH19q', 'i9J854lIcZ', 'RWG81DmnPX', 'W5v8YX60ZW', 'yVH8fpIFXA', 'IDx8nMBTI9'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, wMcB1sc0N2O3Ac93QD.cs High entropy of concatenated method names: 'x1qdKV2LId', 'C1ZdwZWuTM', 'RnDd3hrypM', 'XJUdv8JeGK', 'JJKdLaEsm9', 'KvYdliWm6h', 'JRydrCnMJ2', 'oKNPyjNIhk', 'aUaPxKZn6J', 'AawPbH9xF5'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, QJ4bK7idyGlgewBVjA.cs High entropy of concatenated method names: 'ToString', 'kkI2qahL4S', 'dn12H5giG4', 'QMV2hrB4W2', 'IiU2o2kIV5', 'igN2UGJgNV', 'P9m25lDuyd', 'vKo21rQZjf', 'm9O2YrKtGq', 'MoI2fECnNP'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, cVEO9CMJxhBxSwEjPo.cs High entropy of concatenated method names: 'cVdLJrKdNp', 'QqcL00I2Id', 'ApoLikfPkn', 'fraLa3Xowo', 'HIYLsQqpnx', 'uvWLZV6Xcq', 'UWeLyLCpox', 'NMeLxOPEks', 'LkQLbvLN22', 'gS5LcX9y7F'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, C0BRZ6JVXd9BYAaY0a.cs High entropy of concatenated method names: 'Ga3mnMXZ4j', 'DndmRmaXpL', 't1DmJ94Kb3', 'WC2m0C85PN', 'J1RmH1exqh', 'BrWmhKA2nx', 'qrHmodaLw9', 'bV8mU1OvMW', 'AeTm5Fq41x', 'mFLm1Y8yZn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, awDWTdxUvoQrQOmT8t.cs High entropy of concatenated method names: 'Ac3PvQlrKh', 'Ld2PLNM0pW', 'aOjP8usgSq', 'PqHPlbEcrY', 'UgCPrO0qFI', 'TnQPk7rLJs', 'nqaPTXRVU2', 'JV1P7NWabn', 'tCTPBxRQvX', 'rpCPOErrfM'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, k562qbLTwPvh456TJl.cs High entropy of concatenated method names: 'Dispose', 'wZAKbv7K6O', 'nPk4Hsocrp', 'MN4xxCuK01', 'QKwKcDWTdU', 'foQKzrQOmT', 'ProcessDialogKey', 'htF4N99ed7', 'Dfb4Kfdkng', 'LX344XMcB1'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, MW7AAtVb94AhtfioIn.cs High entropy of concatenated method names: 'BDo6MuyeFt', 'bN36WM10Mv', 'h9l6CBbnqf', 'jL96Hgch8w', 'zIL6oElU54', 'svH6UF5I68', 'ze461km61a', 'cwP6YsrIAN', 'UNM6n14VDR', 'WYW6q2QX6l'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, zYltydKwC9cU3MJwKap.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fsKIJdd99P', 'DNNI0iNsLf', 'oM3IiBjrus', 'F8EIa1vAQL', 'BnfIsxlC2R', 'QnQIZBOTWN', 'tevIyMllLg'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, SxssdYZRImfa3CdMNJ.cs High entropy of concatenated method names: 'jWapx7ivvs', 'Kq8pcwOwUN', 'CBjPNoukAD', 'tqtPKUoXPj', 'UJhpqcK4Uo', 'A6opRH9ALn', 'ToIpVbTKt8', 'FGjpJvsDjW', 'rY4p0grVi6', 'qRCpia3u7u'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, QfBJgfaaKLZGH9VJvl.cs High entropy of concatenated method names: 'O09pBHmISq', 'KnQpORDtX4', 'ToString', 'e6IpvSrnA3', 'L3wpLKCQny', 'z47p886pJH', 'x3aplBrqU8', 'LoMpr4SKEb', 'ovUpkopU5U', 'q7upTTRD9y'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.7fc0000.6.raw.unpack, C0xxRUWEKvpIB10EII.cs High entropy of concatenated method names: 'aRl8j5yEV0', 'lri8uVQdqI', 'mMR8MrVy1m', 'RUK8WpoGwn', 'otO8mSKd1l', 'rH182dGfKr', 's088pCQxTA', 'wp58PdOyn0', 'o6A8dItcNt', 'QCc8IB1Ych'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.raw.unpack, R87QTajabri3WprdxA.cs High entropy of concatenated method names: 'SoFXXYTXBr', 'VXePqW7LxoGttIrQMM', 'VJKqh4rSy8UE5CPs2d', 'w7T6rNymrPsVe05ZjX', 'Qa5usbZfG', 'UsaN6r2JI', 'Dispose', 'xdE70OV1R', 'WKG8Nh2TLfQX7DMBJq', 'FCyDZoO16YhsTUYx7V'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.raw.unpack, I1Ds3abkUA5mh3kywv.cs High entropy of concatenated method names: 'I6pnpGMEc', 'pUPSoKeTB', 'w3OonGh86', 'S3aaCOvyF', 'MagvcleIh', 'hvmph4XfL', 'eXtqEM8mO', 'RC38AH4Bb', 'hyVW2X9uL', 'AbHynsT40'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs High entropy of concatenated method names: 'sRJJ4PC1lt6MgSX9oLN', 'qCuPUJCYMdGJYrcKdqj', 'T9OMNMJAsS', 'KH71sVC96gudd8OjhqS', 'qSoaq8CnboJYXbPCm1H', 'XtbiVDCeUWVlZdG2V08', 'D2TFRiCIaLSytg31rTE', 'MtxGm4CM57HGXUKQMIN', 'RgtTUJcyZL', 'eFmMT9Tlnp'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.raw.unpack, QEHxtuXFnnkJABhbAo.cs High entropy of concatenated method names: 'Geosg7Hdn', 'wwIBOnTmd', 'siWV4YECO', 'k32FNitut', 'cUAG5mh3k', 'JwvHwu9Dw', 'cr1hyajqeLqaQ4F9dK', 'Pgut89mcfAIn6Hs5oN', 'Dispose', 'MoveNext'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.raw.unpack, R87QTajabri3WprdxA.cs High entropy of concatenated method names: 'SoFXXYTXBr', 'VXePqW7LxoGttIrQMM', 'VJKqh4rSy8UE5CPs2d', 'w7T6rNymrPsVe05ZjX', 'Qa5usbZfG', 'UsaN6r2JI', 'Dispose', 'xdE70OV1R', 'WKG8Nh2TLfQX7DMBJq', 'FCyDZoO16YhsTUYx7V'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.raw.unpack, I1Ds3abkUA5mh3kywv.cs High entropy of concatenated method names: 'I6pnpGMEc', 'pUPSoKeTB', 'w3OonGh86', 'S3aaCOvyF', 'MagvcleIh', 'hvmph4XfL', 'eXtqEM8mO', 'RC38AH4Bb', 'hyVW2X9uL', 'AbHynsT40'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs High entropy of concatenated method names: 'sRJJ4PC1lt6MgSX9oLN', 'qCuPUJCYMdGJYrcKdqj', 'T9OMNMJAsS', 'KH71sVC96gudd8OjhqS', 'qSoaq8CnboJYXbPCm1H', 'XtbiVDCeUWVlZdG2V08', 'D2TFRiCIaLSytg31rTE', 'MtxGm4CM57HGXUKQMIN', 'RgtTUJcyZL', 'eFmMT9Tlnp'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.raw.unpack, QEHxtuXFnnkJABhbAo.cs High entropy of concatenated method names: 'Geosg7Hdn', 'wwIBOnTmd', 'siWV4YECO', 'k32FNitut', 'cUAG5mh3k', 'JwvHwu9Dw', 'cr1hyajqeLqaQ4F9dK', 'Pgut89mcfAIn6Hs5oN', 'Dispose', 'MoveNext'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe PID: 6404, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Memory allocated: 1720000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Memory allocated: 3340000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Memory allocated: 3180000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Memory allocated: 8050000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Memory allocated: 9050000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Memory allocated: 9300000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Memory allocated: A300000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D096E rdtsc 6_2_015D096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5921 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3499 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe API coverage: 0.5 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe TID: 5820 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4448 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5580 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Amcache.hve.9.dr Binary or memory string: VMware
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000000.00000002.2060044165.0000000001598000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.9.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe, 00000000.00000002.2060044165.0000000001598000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.9.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D096E rdtsc 6_2_015D096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2DF0 NtQuerySystemInformation,LdrInitializeThunk, 6_2_015D2DF0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664164 mov eax, dword ptr fs:[00000030h] 6_2_01664164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664164 mov eax, dword ptr fs:[00000030h] 6_2_01664164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01596154 mov eax, dword ptr fs:[00000030h] 6_2_01596154
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01596154 mov eax, dword ptr fs:[00000030h] 6_2_01596154
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158C156 mov eax, dword ptr fs:[00000030h] 6_2_0158C156
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01624144 mov eax, dword ptr fs:[00000030h] 6_2_01624144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01624144 mov eax, dword ptr fs:[00000030h] 6_2_01624144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01624144 mov ecx, dword ptr fs:[00000030h] 6_2_01624144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01624144 mov eax, dword ptr fs:[00000030h] 6_2_01624144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01624144 mov eax, dword ptr fs:[00000030h] 6_2_01624144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01628158 mov eax, dword ptr fs:[00000030h] 6_2_01628158
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E10E mov eax, dword ptr fs:[00000030h] 6_2_0163E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E10E mov ecx, dword ptr fs:[00000030h] 6_2_0163E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E10E mov eax, dword ptr fs:[00000030h] 6_2_0163E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E10E mov eax, dword ptr fs:[00000030h] 6_2_0163E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E10E mov ecx, dword ptr fs:[00000030h] 6_2_0163E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E10E mov eax, dword ptr fs:[00000030h] 6_2_0163E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E10E mov eax, dword ptr fs:[00000030h] 6_2_0163E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E10E mov ecx, dword ptr fs:[00000030h] 6_2_0163E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E10E mov eax, dword ptr fs:[00000030h] 6_2_0163E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E10E mov ecx, dword ptr fs:[00000030h] 6_2_0163E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01650115 mov eax, dword ptr fs:[00000030h] 6_2_01650115
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C0124 mov eax, dword ptr fs:[00000030h] 6_2_015C0124
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163A118 mov ecx, dword ptr fs:[00000030h] 6_2_0163A118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163A118 mov eax, dword ptr fs:[00000030h] 6_2_0163A118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163A118 mov eax, dword ptr fs:[00000030h] 6_2_0163A118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163A118 mov eax, dword ptr fs:[00000030h] 6_2_0163A118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016661E5 mov eax, dword ptr fs:[00000030h] 6_2_016661E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C01F8 mov eax, dword ptr fs:[00000030h] 6_2_015C01F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016561C3 mov eax, dword ptr fs:[00000030h] 6_2_016561C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016561C3 mov eax, dword ptr fs:[00000030h] 6_2_016561C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E1D0 mov eax, dword ptr fs:[00000030h] 6_2_0160E1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E1D0 mov eax, dword ptr fs:[00000030h] 6_2_0160E1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E1D0 mov ecx, dword ptr fs:[00000030h] 6_2_0160E1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E1D0 mov eax, dword ptr fs:[00000030h] 6_2_0160E1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E1D0 mov eax, dword ptr fs:[00000030h] 6_2_0160E1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158A197 mov eax, dword ptr fs:[00000030h] 6_2_0158A197
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158A197 mov eax, dword ptr fs:[00000030h] 6_2_0158A197
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158A197 mov eax, dword ptr fs:[00000030h] 6_2_0158A197
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D0185 mov eax, dword ptr fs:[00000030h] 6_2_015D0185
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01634180 mov eax, dword ptr fs:[00000030h] 6_2_01634180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01634180 mov eax, dword ptr fs:[00000030h] 6_2_01634180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0164C188 mov eax, dword ptr fs:[00000030h] 6_2_0164C188
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0164C188 mov eax, dword ptr fs:[00000030h] 6_2_0164C188
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161019F mov eax, dword ptr fs:[00000030h] 6_2_0161019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161019F mov eax, dword ptr fs:[00000030h] 6_2_0161019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161019F mov eax, dword ptr fs:[00000030h] 6_2_0161019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161019F mov eax, dword ptr fs:[00000030h] 6_2_0161019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01592050 mov eax, dword ptr fs:[00000030h] 6_2_01592050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BC073 mov eax, dword ptr fs:[00000030h] 6_2_015BC073
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01616050 mov eax, dword ptr fs:[00000030h] 6_2_01616050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AE016 mov eax, dword ptr fs:[00000030h] 6_2_015AE016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AE016 mov eax, dword ptr fs:[00000030h] 6_2_015AE016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AE016 mov eax, dword ptr fs:[00000030h] 6_2_015AE016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AE016 mov eax, dword ptr fs:[00000030h] 6_2_015AE016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01626030 mov eax, dword ptr fs:[00000030h] 6_2_01626030
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01614000 mov ecx, dword ptr fs:[00000030h] 6_2_01614000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01632000 mov eax, dword ptr fs:[00000030h] 6_2_01632000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01632000 mov eax, dword ptr fs:[00000030h] 6_2_01632000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01632000 mov eax, dword ptr fs:[00000030h] 6_2_01632000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01632000 mov eax, dword ptr fs:[00000030h] 6_2_01632000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01632000 mov eax, dword ptr fs:[00000030h] 6_2_01632000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01632000 mov eax, dword ptr fs:[00000030h] 6_2_01632000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01632000 mov eax, dword ptr fs:[00000030h] 6_2_01632000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01632000 mov eax, dword ptr fs:[00000030h] 6_2_01632000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158A020 mov eax, dword ptr fs:[00000030h] 6_2_0158A020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158C020 mov eax, dword ptr fs:[00000030h] 6_2_0158C020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016160E0 mov eax, dword ptr fs:[00000030h] 6_2_016160E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158C0F0 mov eax, dword ptr fs:[00000030h] 6_2_0158C0F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D20F0 mov ecx, dword ptr fs:[00000030h] 6_2_015D20F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015980E9 mov eax, dword ptr fs:[00000030h] 6_2_015980E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158A0E3 mov ecx, dword ptr fs:[00000030h] 6_2_0158A0E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016120DE mov eax, dword ptr fs:[00000030h] 6_2_016120DE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016280A8 mov eax, dword ptr fs:[00000030h] 6_2_016280A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159208A mov eax, dword ptr fs:[00000030h] 6_2_0159208A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016560B8 mov eax, dword ptr fs:[00000030h] 6_2_016560B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016560B8 mov ecx, dword ptr fs:[00000030h] 6_2_016560B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015880A0 mov eax, dword ptr fs:[00000030h] 6_2_015880A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163437C mov eax, dword ptr fs:[00000030h] 6_2_0163437C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01612349 mov eax, dword ptr fs:[00000030h] 6_2_01612349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0166634F mov eax, dword ptr fs:[00000030h] 6_2_0166634F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01638350 mov ecx, dword ptr fs:[00000030h] 6_2_01638350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165A352 mov eax, dword ptr fs:[00000030h] 6_2_0165A352
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161035C mov eax, dword ptr fs:[00000030h] 6_2_0161035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161035C mov eax, dword ptr fs:[00000030h] 6_2_0161035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161035C mov eax, dword ptr fs:[00000030h] 6_2_0161035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161035C mov ecx, dword ptr fs:[00000030h] 6_2_0161035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161035C mov eax, dword ptr fs:[00000030h] 6_2_0161035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161035C mov eax, dword ptr fs:[00000030h] 6_2_0161035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01668324 mov eax, dword ptr fs:[00000030h] 6_2_01668324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01668324 mov ecx, dword ptr fs:[00000030h] 6_2_01668324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01668324 mov eax, dword ptr fs:[00000030h] 6_2_01668324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01668324 mov eax, dword ptr fs:[00000030h] 6_2_01668324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158C310 mov ecx, dword ptr fs:[00000030h] 6_2_0158C310
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B0310 mov ecx, dword ptr fs:[00000030h] 6_2_015B0310
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA30B mov eax, dword ptr fs:[00000030h] 6_2_015CA30B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA30B mov eax, dword ptr fs:[00000030h] 6_2_015CA30B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA30B mov eax, dword ptr fs:[00000030h] 6_2_015CA30B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0159A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0159A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0159A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0159A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0159A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0159A3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015983C0 mov eax, dword ptr fs:[00000030h] 6_2_015983C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015983C0 mov eax, dword ptr fs:[00000030h] 6_2_015983C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015983C0 mov eax, dword ptr fs:[00000030h] 6_2_015983C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015983C0 mov eax, dword ptr fs:[00000030h] 6_2_015983C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016163C0 mov eax, dword ptr fs:[00000030h] 6_2_016163C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C63FF mov eax, dword ptr fs:[00000030h] 6_2_015C63FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0164C3CD mov eax, dword ptr fs:[00000030h] 6_2_0164C3CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AE3F0 mov eax, dword ptr fs:[00000030h] 6_2_015AE3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AE3F0 mov eax, dword ptr fs:[00000030h] 6_2_015AE3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AE3F0 mov eax, dword ptr fs:[00000030h] 6_2_015AE3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A03E9 mov eax, dword ptr fs:[00000030h] 6_2_015A03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A03E9 mov eax, dword ptr fs:[00000030h] 6_2_015A03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A03E9 mov eax, dword ptr fs:[00000030h] 6_2_015A03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A03E9 mov eax, dword ptr fs:[00000030h] 6_2_015A03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A03E9 mov eax, dword ptr fs:[00000030h] 6_2_015A03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A03E9 mov eax, dword ptr fs:[00000030h] 6_2_015A03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A03E9 mov eax, dword ptr fs:[00000030h] 6_2_015A03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A03E9 mov eax, dword ptr fs:[00000030h] 6_2_015A03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016343D4 mov eax, dword ptr fs:[00000030h] 6_2_016343D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016343D4 mov eax, dword ptr fs:[00000030h] 6_2_016343D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E3DB mov eax, dword ptr fs:[00000030h] 6_2_0163E3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E3DB mov eax, dword ptr fs:[00000030h] 6_2_0163E3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E3DB mov ecx, dword ptr fs:[00000030h] 6_2_0163E3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163E3DB mov eax, dword ptr fs:[00000030h] 6_2_0163E3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01588397 mov eax, dword ptr fs:[00000030h] 6_2_01588397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01588397 mov eax, dword ptr fs:[00000030h] 6_2_01588397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01588397 mov eax, dword ptr fs:[00000030h] 6_2_01588397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158E388 mov eax, dword ptr fs:[00000030h] 6_2_0158E388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158E388 mov eax, dword ptr fs:[00000030h] 6_2_0158E388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158E388 mov eax, dword ptr fs:[00000030h] 6_2_0158E388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B438F mov eax, dword ptr fs:[00000030h] 6_2_015B438F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B438F mov eax, dword ptr fs:[00000030h] 6_2_015B438F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01596259 mov eax, dword ptr fs:[00000030h] 6_2_01596259
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158A250 mov eax, dword ptr fs:[00000030h] 6_2_0158A250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01640274 mov eax, dword ptr fs:[00000030h] 6_2_01640274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01618243 mov eax, dword ptr fs:[00000030h] 6_2_01618243
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01618243 mov ecx, dword ptr fs:[00000030h] 6_2_01618243
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158826B mov eax, dword ptr fs:[00000030h] 6_2_0158826B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0164A250 mov eax, dword ptr fs:[00000030h] 6_2_0164A250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0164A250 mov eax, dword ptr fs:[00000030h] 6_2_0164A250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01594260 mov eax, dword ptr fs:[00000030h] 6_2_01594260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01594260 mov eax, dword ptr fs:[00000030h] 6_2_01594260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01594260 mov eax, dword ptr fs:[00000030h] 6_2_01594260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0166625D mov eax, dword ptr fs:[00000030h] 6_2_0166625D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158823B mov eax, dword ptr fs:[00000030h] 6_2_0158823B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0159A2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0159A2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0159A2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0159A2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0159A2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016662D6 mov eax, dword ptr fs:[00000030h] 6_2_016662D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A02E1 mov eax, dword ptr fs:[00000030h] 6_2_015A02E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A02E1 mov eax, dword ptr fs:[00000030h] 6_2_015A02E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A02E1 mov eax, dword ptr fs:[00000030h] 6_2_015A02E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016262A0 mov eax, dword ptr fs:[00000030h] 6_2_016262A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016262A0 mov ecx, dword ptr fs:[00000030h] 6_2_016262A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016262A0 mov eax, dword ptr fs:[00000030h] 6_2_016262A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016262A0 mov eax, dword ptr fs:[00000030h] 6_2_016262A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016262A0 mov eax, dword ptr fs:[00000030h] 6_2_016262A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016262A0 mov eax, dword ptr fs:[00000030h] 6_2_016262A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE284 mov eax, dword ptr fs:[00000030h] 6_2_015CE284
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE284 mov eax, dword ptr fs:[00000030h] 6_2_015CE284
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01610283 mov eax, dword ptr fs:[00000030h] 6_2_01610283
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01610283 mov eax, dword ptr fs:[00000030h] 6_2_01610283
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01610283 mov eax, dword ptr fs:[00000030h] 6_2_01610283
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A02A0 mov eax, dword ptr fs:[00000030h] 6_2_015A02A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A02A0 mov eax, dword ptr fs:[00000030h] 6_2_015A02A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01598550 mov eax, dword ptr fs:[00000030h] 6_2_01598550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01598550 mov eax, dword ptr fs:[00000030h] 6_2_01598550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C656A mov eax, dword ptr fs:[00000030h] 6_2_015C656A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C656A mov eax, dword ptr fs:[00000030h] 6_2_015C656A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C656A mov eax, dword ptr fs:[00000030h] 6_2_015C656A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01626500 mov eax, dword ptr fs:[00000030h] 6_2_01626500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE53E mov eax, dword ptr fs:[00000030h] 6_2_015BE53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE53E mov eax, dword ptr fs:[00000030h] 6_2_015BE53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE53E mov eax, dword ptr fs:[00000030h] 6_2_015BE53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE53E mov eax, dword ptr fs:[00000030h] 6_2_015BE53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE53E mov eax, dword ptr fs:[00000030h] 6_2_015BE53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664500 mov eax, dword ptr fs:[00000030h] 6_2_01664500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664500 mov eax, dword ptr fs:[00000030h] 6_2_01664500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664500 mov eax, dword ptr fs:[00000030h] 6_2_01664500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664500 mov eax, dword ptr fs:[00000030h] 6_2_01664500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664500 mov eax, dword ptr fs:[00000030h] 6_2_01664500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664500 mov eax, dword ptr fs:[00000030h] 6_2_01664500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664500 mov eax, dword ptr fs:[00000030h] 6_2_01664500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0535 mov eax, dword ptr fs:[00000030h] 6_2_015A0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0535 mov eax, dword ptr fs:[00000030h] 6_2_015A0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0535 mov eax, dword ptr fs:[00000030h] 6_2_015A0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0535 mov eax, dword ptr fs:[00000030h] 6_2_015A0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0535 mov eax, dword ptr fs:[00000030h] 6_2_015A0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0535 mov eax, dword ptr fs:[00000030h] 6_2_015A0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015965D0 mov eax, dword ptr fs:[00000030h] 6_2_015965D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA5D0 mov eax, dword ptr fs:[00000030h] 6_2_015CA5D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA5D0 mov eax, dword ptr fs:[00000030h] 6_2_015CA5D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE5CF mov eax, dword ptr fs:[00000030h] 6_2_015CE5CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE5CF mov eax, dword ptr fs:[00000030h] 6_2_015CE5CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CC5ED mov eax, dword ptr fs:[00000030h] 6_2_015CC5ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CC5ED mov eax, dword ptr fs:[00000030h] 6_2_015CC5ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015925E0 mov eax, dword ptr fs:[00000030h] 6_2_015925E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE5E7 mov eax, dword ptr fs:[00000030h] 6_2_015BE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE5E7 mov eax, dword ptr fs:[00000030h] 6_2_015BE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE5E7 mov eax, dword ptr fs:[00000030h] 6_2_015BE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE5E7 mov eax, dword ptr fs:[00000030h] 6_2_015BE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE5E7 mov eax, dword ptr fs:[00000030h] 6_2_015BE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE5E7 mov eax, dword ptr fs:[00000030h] 6_2_015BE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE5E7 mov eax, dword ptr fs:[00000030h] 6_2_015BE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE5E7 mov eax, dword ptr fs:[00000030h] 6_2_015BE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE59C mov eax, dword ptr fs:[00000030h] 6_2_015CE59C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016105A7 mov eax, dword ptr fs:[00000030h] 6_2_016105A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016105A7 mov eax, dword ptr fs:[00000030h] 6_2_016105A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016105A7 mov eax, dword ptr fs:[00000030h] 6_2_016105A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C4588 mov eax, dword ptr fs:[00000030h] 6_2_015C4588
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01592582 mov eax, dword ptr fs:[00000030h] 6_2_01592582
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01592582 mov ecx, dword ptr fs:[00000030h] 6_2_01592582
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B45B1 mov eax, dword ptr fs:[00000030h] 6_2_015B45B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B45B1 mov eax, dword ptr fs:[00000030h] 6_2_015B45B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B245A mov eax, dword ptr fs:[00000030h] 6_2_015B245A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161C460 mov ecx, dword ptr fs:[00000030h] 6_2_0161C460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158645D mov eax, dword ptr fs:[00000030h] 6_2_0158645D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE443 mov eax, dword ptr fs:[00000030h] 6_2_015CE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE443 mov eax, dword ptr fs:[00000030h] 6_2_015CE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE443 mov eax, dword ptr fs:[00000030h] 6_2_015CE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE443 mov eax, dword ptr fs:[00000030h] 6_2_015CE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE443 mov eax, dword ptr fs:[00000030h] 6_2_015CE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE443 mov eax, dword ptr fs:[00000030h] 6_2_015CE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE443 mov eax, dword ptr fs:[00000030h] 6_2_015CE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CE443 mov eax, dword ptr fs:[00000030h] 6_2_015CE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BA470 mov eax, dword ptr fs:[00000030h] 6_2_015BA470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BA470 mov eax, dword ptr fs:[00000030h] 6_2_015BA470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BA470 mov eax, dword ptr fs:[00000030h] 6_2_015BA470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0164A456 mov eax, dword ptr fs:[00000030h] 6_2_0164A456
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01616420 mov eax, dword ptr fs:[00000030h] 6_2_01616420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01616420 mov eax, dword ptr fs:[00000030h] 6_2_01616420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01616420 mov eax, dword ptr fs:[00000030h] 6_2_01616420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01616420 mov eax, dword ptr fs:[00000030h] 6_2_01616420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01616420 mov eax, dword ptr fs:[00000030h] 6_2_01616420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01616420 mov eax, dword ptr fs:[00000030h] 6_2_01616420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01616420 mov eax, dword ptr fs:[00000030h] 6_2_01616420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C8402 mov eax, dword ptr fs:[00000030h] 6_2_015C8402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C8402 mov eax, dword ptr fs:[00000030h] 6_2_015C8402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C8402 mov eax, dword ptr fs:[00000030h] 6_2_015C8402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA430 mov eax, dword ptr fs:[00000030h] 6_2_015CA430
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158E420 mov eax, dword ptr fs:[00000030h] 6_2_0158E420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158E420 mov eax, dword ptr fs:[00000030h] 6_2_0158E420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158E420 mov eax, dword ptr fs:[00000030h] 6_2_0158E420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158C427 mov eax, dword ptr fs:[00000030h] 6_2_0158C427
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015904E5 mov ecx, dword ptr fs:[00000030h] 6_2_015904E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161A4B0 mov eax, dword ptr fs:[00000030h] 6_2_0161A4B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C44B0 mov ecx, dword ptr fs:[00000030h] 6_2_015C44B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015964AB mov eax, dword ptr fs:[00000030h] 6_2_015964AB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0164A49A mov eax, dword ptr fs:[00000030h] 6_2_0164A49A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01590750 mov eax, dword ptr fs:[00000030h] 6_2_01590750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2750 mov eax, dword ptr fs:[00000030h] 6_2_015D2750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2750 mov eax, dword ptr fs:[00000030h] 6_2_015D2750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C674D mov esi, dword ptr fs:[00000030h] 6_2_015C674D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C674D mov eax, dword ptr fs:[00000030h] 6_2_015C674D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C674D mov eax, dword ptr fs:[00000030h] 6_2_015C674D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01598770 mov eax, dword ptr fs:[00000030h] 6_2_01598770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0770 mov eax, dword ptr fs:[00000030h] 6_2_015A0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01614755 mov eax, dword ptr fs:[00000030h] 6_2_01614755
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161E75D mov eax, dword ptr fs:[00000030h] 6_2_0161E75D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01590710 mov eax, dword ptr fs:[00000030h] 6_2_01590710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C0710 mov eax, dword ptr fs:[00000030h] 6_2_015C0710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160C730 mov eax, dword ptr fs:[00000030h] 6_2_0160C730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CC700 mov eax, dword ptr fs:[00000030h] 6_2_015CC700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C273C mov eax, dword ptr fs:[00000030h] 6_2_015C273C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C273C mov ecx, dword ptr fs:[00000030h] 6_2_015C273C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C273C mov eax, dword ptr fs:[00000030h] 6_2_015C273C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CC720 mov eax, dword ptr fs:[00000030h] 6_2_015CC720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CC720 mov eax, dword ptr fs:[00000030h] 6_2_015CC720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161E7E1 mov eax, dword ptr fs:[00000030h] 6_2_0161E7E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159C7C0 mov eax, dword ptr fs:[00000030h] 6_2_0159C7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016107C3 mov eax, dword ptr fs:[00000030h] 6_2_016107C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015947FB mov eax, dword ptr fs:[00000030h] 6_2_015947FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015947FB mov eax, dword ptr fs:[00000030h] 6_2_015947FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B27ED mov eax, dword ptr fs:[00000030h] 6_2_015B27ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B27ED mov eax, dword ptr fs:[00000030h] 6_2_015B27ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B27ED mov eax, dword ptr fs:[00000030h] 6_2_015B27ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016447A0 mov eax, dword ptr fs:[00000030h] 6_2_016447A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163678E mov eax, dword ptr fs:[00000030h] 6_2_0163678E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015907AF mov eax, dword ptr fs:[00000030h] 6_2_015907AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165866E mov eax, dword ptr fs:[00000030h] 6_2_0165866E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165866E mov eax, dword ptr fs:[00000030h] 6_2_0165866E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AC640 mov eax, dword ptr fs:[00000030h] 6_2_015AC640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C2674 mov eax, dword ptr fs:[00000030h] 6_2_015C2674
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA660 mov eax, dword ptr fs:[00000030h] 6_2_015CA660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA660 mov eax, dword ptr fs:[00000030h] 6_2_015CA660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D2619 mov eax, dword ptr fs:[00000030h] 6_2_015D2619
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A260B mov eax, dword ptr fs:[00000030h] 6_2_015A260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A260B mov eax, dword ptr fs:[00000030h] 6_2_015A260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A260B mov eax, dword ptr fs:[00000030h] 6_2_015A260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A260B mov eax, dword ptr fs:[00000030h] 6_2_015A260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A260B mov eax, dword ptr fs:[00000030h] 6_2_015A260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A260B mov eax, dword ptr fs:[00000030h] 6_2_015A260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A260B mov eax, dword ptr fs:[00000030h] 6_2_015A260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E609 mov eax, dword ptr fs:[00000030h] 6_2_0160E609
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159262C mov eax, dword ptr fs:[00000030h] 6_2_0159262C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C6620 mov eax, dword ptr fs:[00000030h] 6_2_015C6620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C8620 mov eax, dword ptr fs:[00000030h] 6_2_015C8620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015AE627 mov eax, dword ptr fs:[00000030h] 6_2_015AE627
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016106F1 mov eax, dword ptr fs:[00000030h] 6_2_016106F1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016106F1 mov eax, dword ptr fs:[00000030h] 6_2_016106F1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E6F2 mov eax, dword ptr fs:[00000030h] 6_2_0160E6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E6F2 mov eax, dword ptr fs:[00000030h] 6_2_0160E6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E6F2 mov eax, dword ptr fs:[00000030h] 6_2_0160E6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E6F2 mov eax, dword ptr fs:[00000030h] 6_2_0160E6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA6C7 mov ebx, dword ptr fs:[00000030h] 6_2_015CA6C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA6C7 mov eax, dword ptr fs:[00000030h] 6_2_015CA6C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01594690 mov eax, dword ptr fs:[00000030h] 6_2_01594690
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01594690 mov eax, dword ptr fs:[00000030h] 6_2_01594690
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C66B0 mov eax, dword ptr fs:[00000030h] 6_2_015C66B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CC6A6 mov eax, dword ptr fs:[00000030h] 6_2_015CC6A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01634978 mov eax, dword ptr fs:[00000030h] 6_2_01634978
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01634978 mov eax, dword ptr fs:[00000030h] 6_2_01634978
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161C97C mov eax, dword ptr fs:[00000030h] 6_2_0161C97C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664940 mov eax, dword ptr fs:[00000030h] 6_2_01664940
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01610946 mov eax, dword ptr fs:[00000030h] 6_2_01610946
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D096E mov eax, dword ptr fs:[00000030h] 6_2_015D096E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D096E mov edx, dword ptr fs:[00000030h] 6_2_015D096E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015D096E mov eax, dword ptr fs:[00000030h] 6_2_015D096E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B6962 mov eax, dword ptr fs:[00000030h] 6_2_015B6962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B6962 mov eax, dword ptr fs:[00000030h] 6_2_015B6962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B6962 mov eax, dword ptr fs:[00000030h] 6_2_015B6962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01588918 mov eax, dword ptr fs:[00000030h] 6_2_01588918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01588918 mov eax, dword ptr fs:[00000030h] 6_2_01588918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0162892B mov eax, dword ptr fs:[00000030h] 6_2_0162892B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161892A mov eax, dword ptr fs:[00000030h] 6_2_0161892A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E908 mov eax, dword ptr fs:[00000030h] 6_2_0160E908
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160E908 mov eax, dword ptr fs:[00000030h] 6_2_0160E908
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161C912 mov eax, dword ptr fs:[00000030h] 6_2_0161C912
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161E9E0 mov eax, dword ptr fs:[00000030h] 6_2_0161E9E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0159A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0159A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0159A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0159A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0159A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0159A9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C49D0 mov eax, dword ptr fs:[00000030h] 6_2_015C49D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016269C0 mov eax, dword ptr fs:[00000030h] 6_2_016269C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C29F9 mov eax, dword ptr fs:[00000030h] 6_2_015C29F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C29F9 mov eax, dword ptr fs:[00000030h] 6_2_015C29F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165A9D3 mov eax, dword ptr fs:[00000030h] 6_2_0165A9D3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016189B3 mov esi, dword ptr fs:[00000030h] 6_2_016189B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016189B3 mov eax, dword ptr fs:[00000030h] 6_2_016189B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016189B3 mov eax, dword ptr fs:[00000030h] 6_2_016189B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015909AD mov eax, dword ptr fs:[00000030h] 6_2_015909AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015909AD mov eax, dword ptr fs:[00000030h] 6_2_015909AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A29A0 mov eax, dword ptr fs:[00000030h] 6_2_015A29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01594859 mov eax, dword ptr fs:[00000030h] 6_2_01594859
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01594859 mov eax, dword ptr fs:[00000030h] 6_2_01594859
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C0854 mov eax, dword ptr fs:[00000030h] 6_2_015C0854
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01626870 mov eax, dword ptr fs:[00000030h] 6_2_01626870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01626870 mov eax, dword ptr fs:[00000030h] 6_2_01626870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161E872 mov eax, dword ptr fs:[00000030h] 6_2_0161E872
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161E872 mov eax, dword ptr fs:[00000030h] 6_2_0161E872
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A2840 mov ecx, dword ptr fs:[00000030h] 6_2_015A2840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163483A mov eax, dword ptr fs:[00000030h] 6_2_0163483A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163483A mov eax, dword ptr fs:[00000030h] 6_2_0163483A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CA830 mov eax, dword ptr fs:[00000030h] 6_2_015CA830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B2835 mov eax, dword ptr fs:[00000030h] 6_2_015B2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B2835 mov eax, dword ptr fs:[00000030h] 6_2_015B2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B2835 mov eax, dword ptr fs:[00000030h] 6_2_015B2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B2835 mov ecx, dword ptr fs:[00000030h] 6_2_015B2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B2835 mov eax, dword ptr fs:[00000030h] 6_2_015B2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B2835 mov eax, dword ptr fs:[00000030h] 6_2_015B2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161C810 mov eax, dword ptr fs:[00000030h] 6_2_0161C810
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165A8E4 mov eax, dword ptr fs:[00000030h] 6_2_0165A8E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BE8C0 mov eax, dword ptr fs:[00000030h] 6_2_015BE8C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CC8F9 mov eax, dword ptr fs:[00000030h] 6_2_015CC8F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CC8F9 mov eax, dword ptr fs:[00000030h] 6_2_015CC8F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_016608C0 mov eax, dword ptr fs:[00000030h] 6_2_016608C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01590887 mov eax, dword ptr fs:[00000030h] 6_2_01590887
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161C89D mov eax, dword ptr fs:[00000030h] 6_2_0161C89D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01588B50 mov eax, dword ptr fs:[00000030h] 6_2_01588B50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01638B42 mov eax, dword ptr fs:[00000030h] 6_2_01638B42
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01626B40 mov eax, dword ptr fs:[00000030h] 6_2_01626B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01626B40 mov eax, dword ptr fs:[00000030h] 6_2_01626B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0165AB40 mov eax, dword ptr fs:[00000030h] 6_2_0165AB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0158CB7E mov eax, dword ptr fs:[00000030h] 6_2_0158CB7E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01644B4B mov eax, dword ptr fs:[00000030h] 6_2_01644B4B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01644B4B mov eax, dword ptr fs:[00000030h] 6_2_01644B4B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01662B57 mov eax, dword ptr fs:[00000030h] 6_2_01662B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01662B57 mov eax, dword ptr fs:[00000030h] 6_2_01662B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01662B57 mov eax, dword ptr fs:[00000030h] 6_2_01662B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01662B57 mov eax, dword ptr fs:[00000030h] 6_2_01662B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163EB50 mov eax, dword ptr fs:[00000030h] 6_2_0163EB50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01658B28 mov eax, dword ptr fs:[00000030h] 6_2_01658B28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01658B28 mov eax, dword ptr fs:[00000030h] 6_2_01658B28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01664B00 mov eax, dword ptr fs:[00000030h] 6_2_01664B00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BEB20 mov eax, dword ptr fs:[00000030h] 6_2_015BEB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BEB20 mov eax, dword ptr fs:[00000030h] 6_2_015BEB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160EB1D mov eax, dword ptr fs:[00000030h] 6_2_0160EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160EB1D mov eax, dword ptr fs:[00000030h] 6_2_0160EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160EB1D mov eax, dword ptr fs:[00000030h] 6_2_0160EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160EB1D mov eax, dword ptr fs:[00000030h] 6_2_0160EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160EB1D mov eax, dword ptr fs:[00000030h] 6_2_0160EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160EB1D mov eax, dword ptr fs:[00000030h] 6_2_0160EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160EB1D mov eax, dword ptr fs:[00000030h] 6_2_0160EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160EB1D mov eax, dword ptr fs:[00000030h] 6_2_0160EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160EB1D mov eax, dword ptr fs:[00000030h] 6_2_0160EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B0BCB mov eax, dword ptr fs:[00000030h] 6_2_015B0BCB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B0BCB mov eax, dword ptr fs:[00000030h] 6_2_015B0BCB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B0BCB mov eax, dword ptr fs:[00000030h] 6_2_015B0BCB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161CBF0 mov eax, dword ptr fs:[00000030h] 6_2_0161CBF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01590BCD mov eax, dword ptr fs:[00000030h] 6_2_01590BCD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01590BCD mov eax, dword ptr fs:[00000030h] 6_2_01590BCD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01590BCD mov eax, dword ptr fs:[00000030h] 6_2_01590BCD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BEBFC mov eax, dword ptr fs:[00000030h] 6_2_015BEBFC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01598BF0 mov eax, dword ptr fs:[00000030h] 6_2_01598BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01598BF0 mov eax, dword ptr fs:[00000030h] 6_2_01598BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01598BF0 mov eax, dword ptr fs:[00000030h] 6_2_01598BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163EBD0 mov eax, dword ptr fs:[00000030h] 6_2_0163EBD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01644BB0 mov eax, dword ptr fs:[00000030h] 6_2_01644BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01644BB0 mov eax, dword ptr fs:[00000030h] 6_2_01644BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0BBE mov eax, dword ptr fs:[00000030h] 6_2_015A0BBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0BBE mov eax, dword ptr fs:[00000030h] 6_2_015A0BBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0A5B mov eax, dword ptr fs:[00000030h] 6_2_015A0A5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015A0A5B mov eax, dword ptr fs:[00000030h] 6_2_015A0A5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0163EA60 mov eax, dword ptr fs:[00000030h] 6_2_0163EA60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01596A50 mov eax, dword ptr fs:[00000030h] 6_2_01596A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01596A50 mov eax, dword ptr fs:[00000030h] 6_2_01596A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01596A50 mov eax, dword ptr fs:[00000030h] 6_2_01596A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01596A50 mov eax, dword ptr fs:[00000030h] 6_2_01596A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01596A50 mov eax, dword ptr fs:[00000030h] 6_2_01596A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01596A50 mov eax, dword ptr fs:[00000030h] 6_2_01596A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01596A50 mov eax, dword ptr fs:[00000030h] 6_2_01596A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160CA72 mov eax, dword ptr fs:[00000030h] 6_2_0160CA72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0160CA72 mov eax, dword ptr fs:[00000030h] 6_2_0160CA72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CCA6F mov eax, dword ptr fs:[00000030h] 6_2_015CCA6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CCA6F mov eax, dword ptr fs:[00000030h] 6_2_015CCA6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CCA6F mov eax, dword ptr fs:[00000030h] 6_2_015CCA6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CCA38 mov eax, dword ptr fs:[00000030h] 6_2_015CCA38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B4A35 mov eax, dword ptr fs:[00000030h] 6_2_015B4A35
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015B4A35 mov eax, dword ptr fs:[00000030h] 6_2_015B4A35
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0161CA11 mov eax, dword ptr fs:[00000030h] 6_2_0161CA11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015BEA2E mov eax, dword ptr fs:[00000030h] 6_2_015BEA2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CCA24 mov eax, dword ptr fs:[00000030h] 6_2_015CCA24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_01590AD0 mov eax, dword ptr fs:[00000030h] 6_2_01590AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C4AD0 mov eax, dword ptr fs:[00000030h] 6_2_015C4AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C4AD0 mov eax, dword ptr fs:[00000030h] 6_2_015C4AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015E6ACC mov eax, dword ptr fs:[00000030h] 6_2_015E6ACC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015E6ACC mov eax, dword ptr fs:[00000030h] 6_2_015E6ACC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015E6ACC mov eax, dword ptr fs:[00000030h] 6_2_015E6ACC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CAAEE mov eax, dword ptr fs:[00000030h] 6_2_015CAAEE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015CAAEE mov eax, dword ptr fs:[00000030h] 6_2_015CAAEE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_015C8A90 mov edx, dword ptr fs:[00000030h] 6_2_015C8A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159EA80 mov eax, dword ptr fs:[00000030h] 6_2_0159EA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Code function: 6_2_0159EA80 mov eax, dword ptr fs:[00000030h] 6_2_0159EA80
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.9.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.2226854147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2065248520.00000000074A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2061019851.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.2226854147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.74a0000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe.336986c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2065248520.00000000074A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2061019851.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1417468 Sample: SecuriteInfo.com.Win32.PWSX... Startdate: 29/03/2024 Architecture: WINDOWS Score: 100 22 Malicious sample detected (through community Yara rule) 2->22 24 Antivirus / Scanner detection for submitted sample 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 7 other signatures 2->28 7 SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe 4 2->7         started        process3 signatures4 30 Adds a directory exclusion to Windows Defender 7->30 32 Injects a PE file into a foreign processes 7->32 10 powershell.exe 23 7->10         started        12 SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe 7->12         started        14 SecuriteInfo.com.Win32.PWSX-gen.19616.15130.exe 7->14         started        process5 process6 16 WmiPrvSE.exe 10->16         started        18 conhost.exe 10->18         started        20 WerFault.exe 19 16 12->20         started       
⊘No contacted IP infos