Analysis Report PO#560.zip.exe

Overview

General Information

Sample Name: PO#560.zip.exe
Analysis ID: 383967
MD5: 225f5938273f006356fd813e46e3fcef
SHA1: 347cd34fd095ae8f843ee436dde5043bba8fb192
SHA256: 69a395d24a3536ef7698ae036596bed55856d4777356946f498faec3f1395f8d
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains method to dynamically call methods (often used by packers)
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: www.talllensphotography.com/md5/ Avira URL Cloud: Label: malware
Source: http://www.talllensphotography.com/md5/?IBcTaR=Djxti6ShQzh8&DzrLH=JP702FCblU1K1nbBBTKIcgs3vFjx7LTnku6fbfQ3JvhMEqeKMVIpxerk2LYg3Mu/rBkV Avira URL Cloud: Label: malware
Found malware configuration
Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.talllensphotography.com/md5/"], "decoy": ["gnd3.com", "thedrata.com", "carbeloy.com", "impactpittsburg.com", "sussage.com", "mikespencil.com", "ghoshtechno.com", "partnermassagetherapy.com", "nagago.asia", "parkviee.com", "kichisanpo.com", "awbaviation.com", "shopvibeup.com", "ab-alamode.com", "cash4homesutah.com", "funbrushstrokes.com", "adeleycar.com", "actsbooking.com", "rojorodi.icu", "fleurdelyscantho.com", "bobwhiteknives.com", "entrefloresdr.com", "eurostarcellars.com", "shipu143.com", "lindsaydrees.com", "turningtecc.com", "reusedearth.com", "theemperorbrand.com", "afrohiphops.com", "officehoursonly.com", "pharmacistscbd.com", "yaanpay.com", "mymoxypets.com", "sharehealthalliance.com", "sparktvnetwork.com", "marymoorridgecondo.com", "honest-woman.com", "blitzerfoto.net", "vanhanhnhansu.com", "lawyerspledge.com", "parkwashingtondc.com", "worldwideexpressweb.net", "oatml.com", "acquaintancenutritious.info", "lukmanmalik.xyz", "eudorabcantik.com", "fotosdepueblo.com", "latelierp.com", "dogmomtreats.com", "beerthirtyslc.com", "greenlightsmokables.com", "newyorkbusinesssolutions.com", "latravesia.net", "worldvisioncompany.com", "radiusbrisbane.com", "beachhammocking.com", "games-daizo.com", "customkreation.com", "universiteyehazirlan.com", "studentpalace.rentals", "vizecix.com", "new123movies.pro", "skincolored.com", "goldstespresso.com"]}
Multi AV Scanner detection for submitted file
Source: PO#560.zip.exe Virustotal: Detection: 32% Perma Link
Source: PO#560.zip.exe ReversingLabs: Detection: 41%
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.PO#560.zip.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: PO#560.zip.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: PO#560.zip.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: systray.pdb source: PO#560.zip.exe, 00000004.00000002.279505547.00000000014C9000.00000004.00000020.sdmp
Source: Binary string: systray.pdbGCTL source: PO#560.zip.exe, 00000004.00000002.279505547.00000000014C9000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdbUGP source: PO#560.zip.exe, 00000004.00000002.279978802.000000000188F000.00000040.00000001.sdmp, systray.exe, 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: PO#560.zip.exe, 00000004.00000002.279978802.000000000188F000.00000040.00000001.sdmp, systray.exe

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4x nop then pop edi 4_2_00416C9C
Source: C:\Windows\SysWOW64\systray.exe Code function: 4x nop then pop edi 10_2_008C6C9C

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49734 -> 185.53.177.14:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49734 -> 185.53.177.14:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49734 -> 185.53.177.14:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49737 -> 50.118.194.26:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49737 -> 50.118.194.26:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49737 -> 50.118.194.26:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.talllensphotography.com/md5/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /md5/?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G+A1ySyYzJdTo7KJPmykLVFLh3 HTTP/1.1Host: www.mymoxypets.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /md5/?DzrLH=dXMJ/yrosuk4D2OPjKCB839u/6tvM7QWLhghObYdXqbvabebVJQVkG1vpLTC6vFDwMgu&IBcTaR=Djxti6ShQzh8 HTTP/1.1Host: www.new123movies.proConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /md5/?IBcTaR=Djxti6ShQzh8&DzrLH=JP702FCblU1K1nbBBTKIcgs3vFjx7LTnku6fbfQ3JvhMEqeKMVIpxerk2LYg3Mu/rBkV HTTP/1.1Host: www.talllensphotography.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 151.101.1.211 151.101.1.211
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: FASTLYUS FASTLYUS
Source: Joe Sandbox View ASN Name: EGIHOSTINGUS EGIHOSTINGUS
Source: Joe Sandbox View ASN Name: TEAMINTERNET-ASDE TEAMINTERNET-ASDE
Source: global traffic HTTP traffic detected: GET /md5/?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G+A1ySyYzJdTo7KJPmykLVFLh3 HTTP/1.1Host: www.mymoxypets.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /md5/?DzrLH=dXMJ/yrosuk4D2OPjKCB839u/6tvM7QWLhghObYdXqbvabebVJQVkG1vpLTC6vFDwMgu&IBcTaR=Djxti6ShQzh8 HTTP/1.1Host: www.new123movies.proConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /md5/?IBcTaR=Djxti6ShQzh8&DzrLH=JP702FCblU1K1nbBBTKIcgs3vFjx7LTnku6fbfQ3JvhMEqeKMVIpxerk2LYg3Mu/rBkV HTTP/1.1Host: www.talllensphotography.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.mymoxypets.com
Source: explorer.exe, 00000005.00000000.261798460.00000000089BF000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: PO#560.zip.exe, 00000000.00000003.222424567.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.agfamonotype.
Source: PO#560.zip.exe, 00000000.00000003.213421217.00000000060AF000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com2
Source: PO#560.zip.exe, 00000000.00000003.213964934.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com3
Source: PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com9
Source: PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp, PO#560.zip.exe, 00000000.00000003.213964934.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comC
Source: PO#560.zip.exe, 00000000.00000003.213964934.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comI
Source: PO#560.zip.exe, 00000000.00000003.214819617.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comQ
Source: PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comTC
Source: PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comTC)
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comTCm
Source: PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coma
Source: PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comc
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comdd_
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comego
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.como.
Source: PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comwdth
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: PO#560.zip.exe, 00000000.00000003.215738986.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers#
Source: PO#560.zip.exe, 00000000.00000003.215703797.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PO#560.zip.exe, 00000000.00000003.216534912.00000000060B0000.00000004.00000001.sdmp, PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO#560.zip.exe, 00000000.00000003.216063105.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers:
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO#560.zip.exe, 00000000.00000003.215780122.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers_
Source: PO#560.zip.exe, 00000000.00000002.241188316.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comasef
Source: PO#560.zip.exe, 00000000.00000002.241188316.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comav
Source: PO#560.zip.exe, 00000000.00000002.241188316.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comrsiv
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: PO#560.zip.exe, 00000000.00000003.212947601.00000000060AE000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO#560.zip.exe, 00000000.00000003.212947601.00000000060AE000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn;
Source: PO#560.zip.exe, 00000000.00000003.212947601.00000000060AE000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnt-i%
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp, PO#560.zip.exe, 00000000.00000003.214435274.000000000608A000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO#560.zip.exe, 00000000.00000003.214335139.0000000006083000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//d1
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/I
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/R
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/d
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/en-u
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/hs
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: PO#560.zip.exe, 00000000.00000003.214608357.000000000608C000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/I
Source: PO#560.zip.exe, 00000000.00000003.214608357.000000000608C000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/hs
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/n-u
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/w
Source: PO#560.zip.exe, 00000000.00000003.213421217.00000000060AF000.00000004.00000001.sdmp String found in binary or memory: http://www.microsoft.
Source: PO#560.zip.exe, 00000000.00000003.215072761.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.monotype.
Source: PO#560.zip.exe, 00000000.00000003.215261953.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.monotype.4
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cnalv
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cnbio
Source: PO#560.zip.exe String found in binary or memory: https://github.com/michel-pi/EasyBot.Net
Source: systray.exe, 0000000A.00000002.485148191.00000000053BF000.00000004.00000001.sdmp String found in binary or memory: https://my.bigcartel.com;
Source: systray.exe, 0000000A.00000002.485148191.00000000053BF000.00000004.00000001.sdmp String found in binary or memory: https://www.mymoxypets.com/md5?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G
Source: systray.exe, 0000000A.00000002.485148191.00000000053BF000.00000004.00000001.sdmp String found in binary or memory: https://www.mymoxypets.com/md5?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: PO#560.zip.exe, 00000000.00000002.233962937.0000000001540000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: PO#560.zip.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00419D60 NtCreateFile, 4_2_00419D60
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00419E10 NtReadFile, 4_2_00419E10
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00419E90 NtClose, 4_2_00419E90
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00419F40 NtAllocateVirtualMemory, 4_2_00419F40
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00419E0B NtReadFile, 4_2_00419E0B
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00419E8A NtClose, 4_2_00419E8A
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00419F3A NtAllocateVirtualMemory, 4_2_00419F3A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A095D0 NtClose,LdrInitializeThunk, 10_2_04A095D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09540 NtReadFile,LdrInitializeThunk, 10_2_04A09540
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A096E0 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_04A096E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A096D0 NtCreateKey,LdrInitializeThunk, 10_2_04A096D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09660 NtAllocateVirtualMemory,LdrInitializeThunk, 10_2_04A09660
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09650 NtQueryValueKey,LdrInitializeThunk, 10_2_04A09650
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09780 NtMapViewOfSection,LdrInitializeThunk, 10_2_04A09780
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09FE0 NtCreateMutant,LdrInitializeThunk, 10_2_04A09FE0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09710 NtQueryInformationToken,LdrInitializeThunk, 10_2_04A09710
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09860 NtQuerySystemInformation,LdrInitializeThunk, 10_2_04A09860
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09840 NtDelayExecution,LdrInitializeThunk, 10_2_04A09840
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A099A0 NtCreateSection,LdrInitializeThunk, 10_2_04A099A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09910 NtAdjustPrivilegesToken,LdrInitializeThunk, 10_2_04A09910
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09A50 NtCreateFile,LdrInitializeThunk, 10_2_04A09A50
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A095F0 NtQueryInformationFile, 10_2_04A095F0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09520 NtWaitForSingleObject, 10_2_04A09520
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A0AD30 NtSetContextThread, 10_2_04A0AD30
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09560 NtWriteFile, 10_2_04A09560
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09610 NtEnumerateValueKey, 10_2_04A09610
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09670 NtQueryInformationProcess, 10_2_04A09670
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A097A0 NtUnmapViewOfSection, 10_2_04A097A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09730 NtQueryVirtualMemory, 10_2_04A09730
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A0A710 NtOpenProcessToken, 10_2_04A0A710
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09760 NtOpenProcess, 10_2_04A09760
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A0A770 NtOpenThread, 10_2_04A0A770
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09770 NtSetInformationFile, 10_2_04A09770
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A098A0 NtWriteVirtualMemory, 10_2_04A098A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A098F0 NtReadVirtualMemory, 10_2_04A098F0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09820 NtEnumerateKey, 10_2_04A09820
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A0B040 NtSuspendThread, 10_2_04A0B040
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A099D0 NtCreateProcessEx, 10_2_04A099D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09950 NtQueueApcThread, 10_2_04A09950
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09A80 NtOpenDirectoryObject, 10_2_04A09A80
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09A20 NtResumeThread, 10_2_04A09A20
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09A00 NtProtectVirtualMemory, 10_2_04A09A00
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09A10 NtQuerySection, 10_2_04A09A10
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A0A3B0 NtGetContextThread, 10_2_04A0A3B0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A09B00 NtSetValueKey, 10_2_04A09B00
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008C9D60 NtCreateFile, 10_2_008C9D60
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008C9E90 NtClose, 10_2_008C9E90
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008C9E10 NtReadFile, 10_2_008C9E10
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008C9F40 NtAllocateVirtualMemory, 10_2_008C9F40
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008C9E8A NtClose, 10_2_008C9E8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008C9E0B NtReadFile, 10_2_008C9E0B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008C9F3A NtAllocateVirtualMemory, 10_2_008C9F3A
Detected potential crypto function
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_017AC204 0_2_017AC204
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_017AE630 0_2_017AE630
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_017AE620 0_2_017AE620
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE0B20 0_2_02FE0B20
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE1EC8 0_2_02FE1EC8
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE46B0 0_2_02FE46B0
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE4F70 0_2_02FE4F70
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE7CF5 0_2_02FE7CF5
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE4C78 0_2_02FE4C78
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE0A98 0_2_02FE0A98
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE23C8 0_2_02FE23C8
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE0040 0_2_02FE0040
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE0007 0_2_02FE0007
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE4958 0_2_02FE4958
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE494B 0_2_02FE494B
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE1EB8 0_2_02FE1EB8
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE46A1 0_2_02FE46A1
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE6E98 0_2_02FE6E98
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE6E88 0_2_02FE6E88
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE0FE8 0_2_02FE0FE8
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE0FD8 0_2_02FE0FD8
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE4F60 0_2_02FE4F60
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE4C69 0_2_02FE4C69
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE15E8 0_2_02FE15E8
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE15A8 0_2_02FE15A8
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE6510 0_2_02FE6510
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE6500 0_2_02FE6500
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_0041E841 4_2_0041E841
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_0041D018 4_2_0041D018
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00401030 4_2_00401030
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_0041E1FC 4_2_0041E1FC
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00402D87 4_2_00402D87
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00402D90 4_2_00402D90
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00409E40 4_2_00409E40
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00409E3B 4_2_00409E3B
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_0041E7E7 4_2_0041E7E7
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00402FB0 4_2_00402FB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D841F 10_2_049D841F
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8D466 10_2_04A8D466
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F2581 10_2_049F2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A925DD 10_2_04A925DD
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DD5E0 10_2_049DD5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A92D07 10_2_04A92D07
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C0D20 10_2_049C0D20
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A91D55 10_2_04A91D55
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A92EF7 10_2_04A92EF7
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E6E30 10_2_049E6E30
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8D616 10_2_04A8D616
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A91FF1 10_2_04A91FF1
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A9DFCE 10_2_04A9DFCE
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A920A8 10_2_04A920A8
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DB090 10_2_049DB090
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F20A0 10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A928EC 10_2_04A928EC
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A9E824 10_2_04A9E824
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81002 10_2_04A81002
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CF900 10_2_049CF900
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E4120 10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A922AE 10_2_04A922AE
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A7FA2B 10_2_04A7FA2B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FEBB0 10_2_049FEBB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A803DA 10_2_04A803DA
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8DBD2 10_2_04A8DBD2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A92B28 10_2_04A92B28
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008CE1FC 10_2_008CE1FC
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008B2D87 10_2_008B2D87
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008B2D90 10_2_008B2D90
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008B9E3B 10_2_008B9E3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008B9E40 10_2_008B9E40
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008B2FB0 10_2_008B2FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\systray.exe Code function: String function: 049CB150 appears 45 times
PE file contains strange resources
Source: PO#560.zip.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: PO#560.zip.exe, 00000000.00000002.233441652.0000000000E18000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameW vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000000.00000002.236012959.000000000473C000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000000.00000002.247662573.0000000007850000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000000.00000002.234946752.0000000003231000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMetroFramework.dll> vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000000.00000002.233962937.0000000001540000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000004.00000002.279505547.00000000014C9000.00000004.00000020.sdmp Binary or memory string: OriginalFilenamesystray.exej% vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000004.00000000.232128127.0000000000D58000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameW vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000004.00000002.279978802.000000000188F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PO#560.zip.exe
Source: PO#560.zip.exe Binary or memory string: OriginalFilenameW vs PO#560.zip.exe
Uses 32bit PE files
Source: PO#560.zip.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: PO#560.zip.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@4/3
Source: C:\Users\user\Desktop\PO#560.zip.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#560.zip.exe.log Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Mutant created: \Sessions\1\BaseNamedObjects\GxiiSkAr
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3564:120:WilError_01
Source: PO#560.zip.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PO#560.zip.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: PO#560.zip.exe Virustotal: Detection: 32%
Source: PO#560.zip.exe ReversingLabs: Detection: 41%
Source: unknown Process created: C:\Users\user\Desktop\PO#560.zip.exe 'C:\Users\user\Desktop\PO#560.zip.exe'
Source: C:\Users\user\Desktop\PO#560.zip.exe Process created: C:\Users\user\Desktop\PO#560.zip.exe {path}
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO#560.zip.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO#560.zip.exe Process created: C:\Users\user\Desktop\PO#560.zip.exe {path} Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO#560.zip.exe' Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: PO#560.zip.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PO#560.zip.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: systray.pdb source: PO#560.zip.exe, 00000004.00000002.279505547.00000000014C9000.00000004.00000020.sdmp
Source: Binary string: systray.pdbGCTL source: PO#560.zip.exe, 00000004.00000002.279505547.00000000014C9000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdbUGP source: PO#560.zip.exe, 00000004.00000002.279978802.000000000188F000.00000040.00000001.sdmp, systray.exe, 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: PO#560.zip.exe, 00000004.00000002.279978802.000000000188F000.00000040.00000001.sdmp, systray.exe

Data Obfuscation:

barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: PO#560.zip.exe, ImageManager/Main.cs .Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 0.2.PO#560.zip.exe.d60000.0.unpack, ImageManager/Main.cs .Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 0.0.PO#560.zip.exe.d60000.0.unpack, ImageManager/Main.cs .Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 4.0.PO#560.zip.exe.ca0000.0.unpack, ImageManager/Main.cs .Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 4.2.PO#560.zip.exe.ca0000.1.unpack, ImageManager/Main.cs .Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FEAEE5 push FFFFFF8Bh; iretd 0_2_02FEAEE7
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE3FCA push dword ptr [esi]; iretd 0_2_02FE3FD2
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 0_2_02FE3FC3 push 36FFFFFFh; iretd 0_2_02FE3FC8
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_004170A0 pushfd ; retf 4_2_004170A6
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_0041CEB5 push eax; ret 4_2_0041CF08
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_0041CF6C push eax; ret 4_2_0041CF72
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_0041CF02 push eax; ret 4_2_0041CF08
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_0041CF0B push eax; ret 4_2_0041CF72
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A1D0D1 push ecx; ret 10_2_04A1D0E4
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008C70A0 pushfd ; retf 10_2_008C70A6
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008CCEB5 push eax; ret 10_2_008CCF08
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008CCF0B push eax; ret 10_2_008CCF72
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008CCF02 push eax; ret 10_2_008CCF08
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_008CCF6C push eax; ret 10_2_008CCF72
Source: initial sample Static PE information: section name: .text entropy: 7.89802258187

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8A 0xAE 0xEE
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: zip.exe Static PE information: PO#560.zip.exe
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: PO#560.zip.exe PID: 3468, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\PO#560.zip.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\PO#560.zip.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe RDTSC instruction interceptor: First address: 00000000008B98E4 second address: 00000000008B98EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe RDTSC instruction interceptor: First address: 00000000008B9B5E second address: 00000000008B9B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00409A90 rdtsc 4_2_00409A90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PO#560.zip.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PO#560.zip.exe TID: 4112 Thread sleep time: -31500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe TID: 5464 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6684 Thread sleep time: -62000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 912 Thread sleep time: -60000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\PO#560.zip.exe Thread delayed: delay time: 31500 Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: explorer.exe, 00000005.00000000.260447855.0000000008220000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.260973427.0000000008640000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: vmware
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}qqqqqqqqqqqqqq
Source: explorer.exe, 00000005.00000000.253495548.00000000055D0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.261281856.00000000087D1000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000005.00000002.494378645.0000000005603000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.260447855.0000000008220000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.260447855.0000000008220000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000005.00000000.260447855.0000000008220000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\PO#560.zip.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\PO#560.zip.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_00409A90 rdtsc 4_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\PO#560.zip.exe Code function: 4_2_0040ACD0 LdrLoadDll, 4_2_0040ACD0
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D849B mov eax, dword ptr fs:[00000030h] 10_2_049D849B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A814FB mov eax, dword ptr fs:[00000030h] 10_2_04A814FB
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46CF0 mov eax, dword ptr fs:[00000030h] 10_2_04A46CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46CF0 mov eax, dword ptr fs:[00000030h] 10_2_04A46CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46CF0 mov eax, dword ptr fs:[00000030h] 10_2_04A46CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A98CD6 mov eax, dword ptr fs:[00000030h] 10_2_04A98CD6
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A9740D mov eax, dword ptr fs:[00000030h] 10_2_04A9740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A9740D mov eax, dword ptr fs:[00000030h] 10_2_04A9740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A9740D mov eax, dword ptr fs:[00000030h] 10_2_04A9740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h] 10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46C0A mov eax, dword ptr fs:[00000030h] 10_2_04A46C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46C0A mov eax, dword ptr fs:[00000030h] 10_2_04A46C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46C0A mov eax, dword ptr fs:[00000030h] 10_2_04A46C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46C0A mov eax, dword ptr fs:[00000030h] 10_2_04A46C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FBC2C mov eax, dword ptr fs:[00000030h] 10_2_049FBC2C
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FA44B mov eax, dword ptr fs:[00000030h] 10_2_049FA44B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E746D mov eax, dword ptr fs:[00000030h] 10_2_049E746D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5C450 mov eax, dword ptr fs:[00000030h] 10_2_04A5C450
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5C450 mov eax, dword ptr fs:[00000030h] 10_2_04A5C450
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FFD9B mov eax, dword ptr fs:[00000030h] 10_2_049FFD9B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FFD9B mov eax, dword ptr fs:[00000030h] 10_2_049FFD9B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A905AC mov eax, dword ptr fs:[00000030h] 10_2_04A905AC
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A905AC mov eax, dword ptr fs:[00000030h] 10_2_04A905AC
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C2D8A mov eax, dword ptr fs:[00000030h] 10_2_049C2D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C2D8A mov eax, dword ptr fs:[00000030h] 10_2_049C2D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C2D8A mov eax, dword ptr fs:[00000030h] 10_2_049C2D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C2D8A mov eax, dword ptr fs:[00000030h] 10_2_049C2D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C2D8A mov eax, dword ptr fs:[00000030h] 10_2_049C2D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F2581 mov eax, dword ptr fs:[00000030h] 10_2_049F2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F2581 mov eax, dword ptr fs:[00000030h] 10_2_049F2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F2581 mov eax, dword ptr fs:[00000030h] 10_2_049F2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F2581 mov eax, dword ptr fs:[00000030h] 10_2_049F2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F1DB5 mov eax, dword ptr fs:[00000030h] 10_2_049F1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F1DB5 mov eax, dword ptr fs:[00000030h] 10_2_049F1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F1DB5 mov eax, dword ptr fs:[00000030h] 10_2_049F1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F35A1 mov eax, dword ptr fs:[00000030h] 10_2_049F35A1
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8FDE2 mov eax, dword ptr fs:[00000030h] 10_2_04A8FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8FDE2 mov eax, dword ptr fs:[00000030h] 10_2_04A8FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8FDE2 mov eax, dword ptr fs:[00000030h] 10_2_04A8FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8FDE2 mov eax, dword ptr fs:[00000030h] 10_2_04A8FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A78DF1 mov eax, dword ptr fs:[00000030h] 10_2_04A78DF1
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46DC9 mov eax, dword ptr fs:[00000030h] 10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46DC9 mov eax, dword ptr fs:[00000030h] 10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46DC9 mov eax, dword ptr fs:[00000030h] 10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46DC9 mov ecx, dword ptr fs:[00000030h] 10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46DC9 mov eax, dword ptr fs:[00000030h] 10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A46DC9 mov eax, dword ptr fs:[00000030h] 10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DD5E0 mov eax, dword ptr fs:[00000030h] 10_2_049DD5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DD5E0 mov eax, dword ptr fs:[00000030h] 10_2_049DD5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8E539 mov eax, dword ptr fs:[00000030h] 10_2_04A8E539
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A4A537 mov eax, dword ptr fs:[00000030h] 10_2_04A4A537
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A98D34 mov eax, dword ptr fs:[00000030h] 10_2_04A98D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F4D3B mov eax, dword ptr fs:[00000030h] 10_2_049F4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F4D3B mov eax, dword ptr fs:[00000030h] 10_2_049F4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F4D3B mov eax, dword ptr fs:[00000030h] 10_2_049F4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h] 10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CAD30 mov eax, dword ptr fs:[00000030h] 10_2_049CAD30
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E7D50 mov eax, dword ptr fs:[00000030h] 10_2_049E7D50
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A03D43 mov eax, dword ptr fs:[00000030h] 10_2_04A03D43
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A43540 mov eax, dword ptr fs:[00000030h] 10_2_04A43540
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A73D40 mov eax, dword ptr fs:[00000030h] 10_2_04A73D40
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EC577 mov eax, dword ptr fs:[00000030h] 10_2_049EC577
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EC577 mov eax, dword ptr fs:[00000030h] 10_2_049EC577
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A446A7 mov eax, dword ptr fs:[00000030h] 10_2_04A446A7
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A90EA5 mov eax, dword ptr fs:[00000030h] 10_2_04A90EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A90EA5 mov eax, dword ptr fs:[00000030h] 10_2_04A90EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A90EA5 mov eax, dword ptr fs:[00000030h] 10_2_04A90EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5FE87 mov eax, dword ptr fs:[00000030h] 10_2_04A5FE87
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F36CC mov eax, dword ptr fs:[00000030h] 10_2_049F36CC
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A7FEC0 mov eax, dword ptr fs:[00000030h] 10_2_04A7FEC0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A08EC7 mov eax, dword ptr fs:[00000030h] 10_2_04A08EC7
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D76E2 mov eax, dword ptr fs:[00000030h] 10_2_049D76E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A98ED6 mov eax, dword ptr fs:[00000030h] 10_2_04A98ED6
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F16E0 mov ecx, dword ptr fs:[00000030h] 10_2_049F16E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FA61C mov eax, dword ptr fs:[00000030h] 10_2_049FA61C
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FA61C mov eax, dword ptr fs:[00000030h] 10_2_049FA61C
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A7FE3F mov eax, dword ptr fs:[00000030h] 10_2_04A7FE3F
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CC600 mov eax, dword ptr fs:[00000030h] 10_2_049CC600
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CC600 mov eax, dword ptr fs:[00000030h] 10_2_049CC600
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CC600 mov eax, dword ptr fs:[00000030h] 10_2_049CC600
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F8E00 mov eax, dword ptr fs:[00000030h] 10_2_049F8E00
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A81608 mov eax, dword ptr fs:[00000030h] 10_2_04A81608
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CE620 mov eax, dword ptr fs:[00000030h] 10_2_049CE620
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h] 10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h] 10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h] 10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h] 10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h] 10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h] 10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8AE44 mov eax, dword ptr fs:[00000030h] 10_2_04A8AE44
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8AE44 mov eax, dword ptr fs:[00000030h] 10_2_04A8AE44
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EAE73 mov eax, dword ptr fs:[00000030h] 10_2_049EAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EAE73 mov eax, dword ptr fs:[00000030h] 10_2_049EAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EAE73 mov eax, dword ptr fs:[00000030h] 10_2_049EAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EAE73 mov eax, dword ptr fs:[00000030h] 10_2_049EAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EAE73 mov eax, dword ptr fs:[00000030h] 10_2_049EAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D766D mov eax, dword ptr fs:[00000030h] 10_2_049D766D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D8794 mov eax, dword ptr fs:[00000030h] 10_2_049D8794
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A47794 mov eax, dword ptr fs:[00000030h] 10_2_04A47794
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A47794 mov eax, dword ptr fs:[00000030h] 10_2_04A47794
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A47794 mov eax, dword ptr fs:[00000030h] 10_2_04A47794
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A037F5 mov eax, dword ptr fs:[00000030h] 10_2_04A037F5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EF716 mov eax, dword ptr fs:[00000030h] 10_2_049EF716
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FA70E mov eax, dword ptr fs:[00000030h] 10_2_049FA70E
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FA70E mov eax, dword ptr fs:[00000030h] 10_2_049FA70E
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A9070D mov eax, dword ptr fs:[00000030h] 10_2_04A9070D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A9070D mov eax, dword ptr fs:[00000030h] 10_2_04A9070D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FE730 mov eax, dword ptr fs:[00000030h] 10_2_049FE730
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C4F2E mov eax, dword ptr fs:[00000030h] 10_2_049C4F2E
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C4F2E mov eax, dword ptr fs:[00000030h] 10_2_049C4F2E
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5FF10 mov eax, dword ptr fs:[00000030h] 10_2_04A5FF10
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5FF10 mov eax, dword ptr fs:[00000030h] 10_2_04A5FF10
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A98F6A mov eax, dword ptr fs:[00000030h] 10_2_04A98F6A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DEF40 mov eax, dword ptr fs:[00000030h] 10_2_049DEF40
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DFF60 mov eax, dword ptr fs:[00000030h] 10_2_049DFF60
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A090AF mov eax, dword ptr fs:[00000030h] 10_2_04A090AF
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C9080 mov eax, dword ptr fs:[00000030h] 10_2_049C9080
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FF0BF mov ecx, dword ptr fs:[00000030h] 10_2_049FF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FF0BF mov eax, dword ptr fs:[00000030h] 10_2_049FF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FF0BF mov eax, dword ptr fs:[00000030h] 10_2_049FF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A43884 mov eax, dword ptr fs:[00000030h] 10_2_04A43884
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A43884 mov eax, dword ptr fs:[00000030h] 10_2_04A43884
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h] 10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h] 10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h] 10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h] 10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h] 10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h] 10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C58EC mov eax, dword ptr fs:[00000030h] 10_2_049C58EC
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5B8D0 mov eax, dword ptr fs:[00000030h] 10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5B8D0 mov ecx, dword ptr fs:[00000030h] 10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5B8D0 mov eax, dword ptr fs:[00000030h] 10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5B8D0 mov eax, dword ptr fs:[00000030h] 10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5B8D0 mov eax, dword ptr fs:[00000030h] 10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A5B8D0 mov eax, dword ptr fs:[00000030h] 10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C40E1 mov eax, dword ptr fs:[00000030h] 10_2_049C40E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C40E1 mov eax, dword ptr fs:[00000030h] 10_2_049C40E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C40E1 mov eax, dword ptr fs:[00000030h] 10_2_049C40E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A47016 mov eax, dword ptr fs:[00000030h] 10_2_04A47016
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A47016 mov eax, dword ptr fs:[00000030h] 10_2_04A47016
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A47016 mov eax, dword ptr fs:[00000030h] 10_2_04A47016
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F002D mov eax, dword ptr fs:[00000030h] 10_2_049F002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F002D mov eax, dword ptr fs:[00000030h] 10_2_049F002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F002D mov eax, dword ptr fs:[00000030h] 10_2_049F002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F002D mov eax, dword ptr fs:[00000030h] 10_2_049F002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F002D mov eax, dword ptr fs:[00000030h] 10_2_049F002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DB02A mov eax, dword ptr fs:[00000030h] 10_2_049DB02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DB02A mov eax, dword ptr fs:[00000030h] 10_2_049DB02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DB02A mov eax, dword ptr fs:[00000030h] 10_2_049DB02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DB02A mov eax, dword ptr fs:[00000030h] 10_2_049DB02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A94015 mov eax, dword ptr fs:[00000030h] 10_2_04A94015
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A94015 mov eax, dword ptr fs:[00000030h] 10_2_04A94015
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E0050 mov eax, dword ptr fs:[00000030h] 10_2_049E0050
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E0050 mov eax, dword ptr fs:[00000030h] 10_2_049E0050
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A82073 mov eax, dword ptr fs:[00000030h] 10_2_04A82073
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A91074 mov eax, dword ptr fs:[00000030h] 10_2_04A91074
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A469A6 mov eax, dword ptr fs:[00000030h] 10_2_04A469A6
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A849A4 mov eax, dword ptr fs:[00000030h] 10_2_04A849A4
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A849A4 mov eax, dword ptr fs:[00000030h] 10_2_04A849A4
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A849A4 mov eax, dword ptr fs:[00000030h] 10_2_04A849A4
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A849A4 mov eax, dword ptr fs:[00000030h] 10_2_04A849A4
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F2990 mov eax, dword ptr fs:[00000030h] 10_2_049F2990
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FA185 mov eax, dword ptr fs:[00000030h] 10_2_049FA185
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A451BE mov eax, dword ptr fs:[00000030h] 10_2_04A451BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A451BE mov eax, dword ptr fs:[00000030h] 10_2_04A451BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A451BE mov eax, dword ptr fs:[00000030h] 10_2_04A451BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A451BE mov eax, dword ptr fs:[00000030h] 10_2_04A451BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EC182 mov eax, dword ptr fs:[00000030h] 10_2_049EC182
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F61A0 mov eax, dword ptr fs:[00000030h] 10_2_049F61A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F61A0 mov eax, dword ptr fs:[00000030h] 10_2_049F61A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A541E8 mov eax, dword ptr fs:[00000030h] 10_2_04A541E8
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CB1E1 mov eax, dword ptr fs:[00000030h] 10_2_049CB1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CB1E1 mov eax, dword ptr fs:[00000030h] 10_2_049CB1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CB1E1 mov eax, dword ptr fs:[00000030h] 10_2_049CB1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C9100 mov eax, dword ptr fs:[00000030h] 10_2_049C9100
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C9100 mov eax, dword ptr fs:[00000030h] 10_2_049C9100
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C9100 mov eax, dword ptr fs:[00000030h] 10_2_049C9100
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F513A mov eax, dword ptr fs:[00000030h] 10_2_049F513A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F513A mov eax, dword ptr fs:[00000030h] 10_2_049F513A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E4120 mov eax, dword ptr fs:[00000030h] 10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E4120 mov eax, dword ptr fs:[00000030h] 10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E4120 mov eax, dword ptr fs:[00000030h] 10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E4120 mov eax, dword ptr fs:[00000030h] 10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E4120 mov ecx, dword ptr fs:[00000030h] 10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EB944 mov eax, dword ptr fs:[00000030h] 10_2_049EB944
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EB944 mov eax, dword ptr fs:[00000030h] 10_2_049EB944
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CB171 mov eax, dword ptr fs:[00000030h] 10_2_049CB171
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CB171 mov eax, dword ptr fs:[00000030h] 10_2_049CB171
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CC962 mov eax, dword ptr fs:[00000030h] 10_2_049CC962
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FD294 mov eax, dword ptr fs:[00000030h] 10_2_049FD294
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FD294 mov eax, dword ptr fs:[00000030h] 10_2_049FD294
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DAAB0 mov eax, dword ptr fs:[00000030h] 10_2_049DAAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049DAAB0 mov eax, dword ptr fs:[00000030h] 10_2_049DAAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FFAB0 mov eax, dword ptr fs:[00000030h] 10_2_049FFAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C52A5 mov eax, dword ptr fs:[00000030h] 10_2_049C52A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C52A5 mov eax, dword ptr fs:[00000030h] 10_2_049C52A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C52A5 mov eax, dword ptr fs:[00000030h] 10_2_049C52A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C52A5 mov eax, dword ptr fs:[00000030h] 10_2_049C52A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C52A5 mov eax, dword ptr fs:[00000030h] 10_2_049C52A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F2ACB mov eax, dword ptr fs:[00000030h] 10_2_049F2ACB
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F2AE4 mov eax, dword ptr fs:[00000030h] 10_2_049F2AE4
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049E3A1C mov eax, dword ptr fs:[00000030h] 10_2_049E3A1C
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CAA16 mov eax, dword ptr fs:[00000030h] 10_2_049CAA16
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CAA16 mov eax, dword ptr fs:[00000030h] 10_2_049CAA16
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A04A2C mov eax, dword ptr fs:[00000030h] 10_2_04A04A2C
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A04A2C mov eax, dword ptr fs:[00000030h] 10_2_04A04A2C
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C5210 mov eax, dword ptr fs:[00000030h] 10_2_049C5210
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C5210 mov ecx, dword ptr fs:[00000030h] 10_2_049C5210
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C5210 mov eax, dword ptr fs:[00000030h] 10_2_049C5210
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C5210 mov eax, dword ptr fs:[00000030h] 10_2_049C5210
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D8A0A mov eax, dword ptr fs:[00000030h] 10_2_049D8A0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8AA16 mov eax, dword ptr fs:[00000030h] 10_2_04A8AA16
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8AA16 mov eax, dword ptr fs:[00000030h] 10_2_04A8AA16
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A7B260 mov eax, dword ptr fs:[00000030h] 10_2_04A7B260
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A7B260 mov eax, dword ptr fs:[00000030h] 10_2_04A7B260
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A98A62 mov eax, dword ptr fs:[00000030h] 10_2_04A98A62
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A0927A mov eax, dword ptr fs:[00000030h] 10_2_04A0927A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C9240 mov eax, dword ptr fs:[00000030h] 10_2_049C9240
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C9240 mov eax, dword ptr fs:[00000030h] 10_2_049C9240
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C9240 mov eax, dword ptr fs:[00000030h] 10_2_049C9240
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049C9240 mov eax, dword ptr fs:[00000030h] 10_2_049C9240
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A54257 mov eax, dword ptr fs:[00000030h] 10_2_04A54257
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8EA55 mov eax, dword ptr fs:[00000030h] 10_2_04A8EA55
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F2397 mov eax, dword ptr fs:[00000030h] 10_2_049F2397
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A95BA5 mov eax, dword ptr fs:[00000030h] 10_2_04A95BA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049FB390 mov eax, dword ptr fs:[00000030h] 10_2_049FB390
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D1B8F mov eax, dword ptr fs:[00000030h] 10_2_049D1B8F
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049D1B8F mov eax, dword ptr fs:[00000030h] 10_2_049D1B8F
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8138A mov eax, dword ptr fs:[00000030h] 10_2_04A8138A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A7D380 mov ecx, dword ptr fs:[00000030h] 10_2_04A7D380
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F4BAD mov eax, dword ptr fs:[00000030h] 10_2_049F4BAD
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F4BAD mov eax, dword ptr fs:[00000030h] 10_2_049F4BAD
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F4BAD mov eax, dword ptr fs:[00000030h] 10_2_049F4BAD
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A453CA mov eax, dword ptr fs:[00000030h] 10_2_04A453CA
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A453CA mov eax, dword ptr fs:[00000030h] 10_2_04A453CA
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049EDBE9 mov eax, dword ptr fs:[00000030h] 10_2_049EDBE9
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h] 10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h] 10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h] 10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h] 10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h] 10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h] 10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A8131B mov eax, dword ptr fs:[00000030h] 10_2_04A8131B
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CF358 mov eax, dword ptr fs:[00000030h] 10_2_049CF358
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CDB40 mov eax, dword ptr fs:[00000030h] 10_2_049CDB40
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F3B7A mov eax, dword ptr fs:[00000030h] 10_2_049F3B7A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049F3B7A mov eax, dword ptr fs:[00000030h] 10_2_049F3B7A
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_04A98B58 mov eax, dword ptr fs:[00000030h] 10_2_04A98B58
Source: C:\Windows\SysWOW64\systray.exe Code function: 10_2_049CDB60 mov ecx, dword ptr fs:[00000030h] 10_2_049CDB60
Enables debug privileges
Source: C:\Users\user\Desktop\PO#560.zip.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 151.101.1.211 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 50.118.194.26 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.mymoxypets.com
Source: C:\Windows\explorer.exe Domain query: www.new123movies.pro
Source: C:\Windows\explorer.exe Network Connect: 185.53.177.14 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.talllensphotography.com
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PO#560.zip.exe Memory written: C:\Users\user\Desktop\PO#560.zip.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\PO#560.zip.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\PO#560.zip.exe Thread register set: target process: 3388 Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Thread register set: target process: 3388 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\PO#560.zip.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\PO#560.zip.exe Section unmapped: C:\Windows\SysWOW64\systray.exe base address: C50000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO#560.zip.exe Process created: C:\Users\user\Desktop\PO#560.zip.exe {path} Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO#560.zip.exe' Jump to behavior
Source: explorer.exe, 00000005.00000002.479927551.0000000001398000.00000004.00000020.sdmp Binary or memory string: ProgmanamF
Source: explorer.exe, 00000005.00000002.481518579.0000000001980000.00000002.00000001.sdmp, systray.exe, 0000000A.00000002.480606169.0000000003250000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp, systray.exe, 0000000A.00000002.480606169.0000000003250000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000002.481518579.0000000001980000.00000002.00000001.sdmp, systray.exe, 0000000A.00000002.480606169.0000000003250000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000002.481518579.0000000001980000.00000002.00000001.sdmp, systray.exe, 0000000A.00000002.480606169.0000000003250000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Users\user\Desktop\PO#560.zip.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 383967 Sample: PO#560.zip.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 31 www.turningtecc.com 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 10 other signatures 2->45 11 PO#560.zip.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\PO#560.zip.exe.log, ASCII 11->29 dropped 55 Tries to detect virtualization through RDTSC time measurements 11->55 57 Injects a PE file into a foreign processes 11->57 15 PO#560.zip.exe 11->15         started        signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 15->59 61 Maps a DLL or memory area into another process 15->61 63 Sample uses process hollowing technique 15->63 65 Queues an APC in another process (thread injection) 15->65 18 explorer.exe 15->18 injected process9 dnsIp10 33 www.new123movies.pro 185.53.177.14, 49734, 80 TEAMINTERNET-ASDE Germany 18->33 35 dualstack.sni.bigcartel.map.fastly.net 151.101.1.211, 49732, 80 FASTLYUS United States 18->35 37 3 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 systray.exe 18->22         started        signatures11 process12 signatures13 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
151.101.1.211
 dualstack.sni.bigcartel.map.fastly.net United States
54113 FASTLYUS true
50.118.194.26
 www.talllensphotography.com United States
18779 EGIHOSTINGUS true
185.53.177.14
 www.new123movies.pro Germany
61969 TEAMINTERNET-ASDE true

Contacted Domains

Name IP Active
www.new123movies.pro 185.53.177.14 true
dualstack.sni.bigcartel.map.fastly.net 151.101.1.211 true
www.talllensphotography.com 50.118.194.26 true
www.turningtecc.com unknown unknown
www.mymoxypets.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.mymoxypets.com/md5/?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G+A1ySyYzJdTo7KJPmykLVFLh3 true
  • Avira URL Cloud: safe
 unknown
http://www.new123movies.pro/md5/?DzrLH=dXMJ/yrosuk4D2OPjKCB839u/6tvM7QWLhghObYdXqbvabebVJQVkG1vpLTC6vFDwMgu&IBcTaR=Djxti6ShQzh8 true
  • Avira URL Cloud: safe
 unknown
www.talllensphotography.com/md5/ true
  • Avira URL Cloud: malware
 low
http://www.talllensphotography.com/md5/?IBcTaR=Djxti6ShQzh8&DzrLH=JP702FCblU1K1nbBBTKIcgs3vFjx7LTnku6fbfQ3JvhMEqeKMVIpxerk2LYg3Mu/rBkV true
  • Avira URL Cloud: malware
 unknown