Analysis Report TT.exe

AV Detection:

Found malware configuration

Source: 00000007.00000002.597321036.0000000002F60000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.knighttechinca.com/dxe/"], "decoy": ["sardarfarm.com", "959tremont.com", "privat-livecam.net", "ansel-homebakery.com", "joysupermarket.com", "peninsulamatchmakers.net", "northsytyle.com", "radioconexaoubermusic.com", "relocatingrealtor.com", "desyrnan.com", "onlinehoortoestel.online", "enpointe.online", "rvvikings.com", "paulpoirier.com", "shitarpa.net", "kerneis.net", "rokitreach.com", "essentiallygaia.com", "prestiged.net", "fuerzaagavera.com", "soukid.com", "moderndatingcoach.com", "mentalfreedom.guru", "bullishsoftware.com", "sectorulb.com", "outletyana.com", "fptplaybox.website", "artinmemory.com", "buyruon.com", "ljd.xyz", "mondaysmatters.com", "spiritsoundart.net", "ixiangzu.com", "lacompagniadelfardello.com", "bnctly.com", "sarasvati-yoga.com", "0055game.com", "lagrangewildliferemoval.com", "umlausa.com", "chaytel.com", "kkkc5.com", "union-green.com", "philreid4cc.com", "theanimehat.com", "redlightlegal.com", "myaustraliarewards.com", "barkinlot.com", "mujahidservice.online", "nugeneraonline.com", "sopplugin.com", "makemyroom.design", "ferienschweden.com", "fps2020dkasphotoop.com", "stylezbykay.com", "royalpropertiesgurugram.com", "birzulova.com", "cosmicmtn.com", "kissanime.press", "poweringprogress.today", "omsamedic.com", "drunkpoetsociety.com", "hostbison.com", "asapdecor.com", "houseofsisson.com"]}

Multi AV Scanner detection for submitted file

Source: TT.exe	Virustotal: Detection: 25%			Perma Link
Source: TT.exe	ReversingLabs: Detection: 40%

Yara detected FormBook

Source: Yara match	File source: 00000007.00000002.597321036.0000000002F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.392835395.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.393512483.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.595686544.00000000007C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.335739935.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.344692024.0000000003030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.597417500.0000000002F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.392976261.00000000005E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT.exe.3030000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.TT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT.exe.3030000.4.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: TT.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 1.2.TT.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.1.TT.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.TT.exe.3030000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: TT.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: TT.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.366025907.000000000DC20000.00000002.00000001.sdmp
Source:	Binary string: msdt.pdbGCTL source: TT.exe, 00000001.00000002.396335168.0000000002810000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: TT.exe, 00000000.00000003.331979334.0000000003060000.00000004.00000001.sdmp, TT.exe, 00000001.00000002.393874457.0000000000B4F000.00000040.00000001.sdmp, msdt.exe, 00000007.00000002.598843723.0000000004DFF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: TT.exe, msdt.exe
Source:	Binary string: msdt.pdb source: TT.exe, 00000001.00000002.396335168.0000000002810000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.366025907.000000000DC20000.00000002.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\TT.exe	Code function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		0_2_004059F0
Source: C:\Users\user\Desktop\TT.exe	Code function: 0_2_0040659C FindFirstFileA,FindClose,		0_2_0040659C
Source: C:\Users\user\Desktop\TT.exe	Code function: 0_2_004027A1 FindFirstFileA,		0_2_004027A1

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.knighttechinca.com/dxe/

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /dxe/?oZN=7nbLudZHS&mdslXXV=s4725d3Oabb4GJPvvzs1NGtrQqdCSFbT14B5hiC+hEbCkkM6v8NMU0M9YHV7hr/JdwNsVvK8Ug== HTTP/1.1Host: www.philreid4cc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dxe/?mdslXXV=c1qXo+D3OeWS7aQwzsMJrh0J2W+ZcnXSIybZATOUAxrA4uZvd+OeJvPZ6sfOQ4L/XOcBlc02WQ==&oZN=7nbLudZHS HTTP/1.1Host: www.sectorulb.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dxe/?oZN=7nbLudZHS&mdslXXV=pSmvUx3Cd9o2ehLRUYmTuUG+rz67XAZoYuLBzxOhEanl5TCXMyweO2X8MqC68oVFQcjckZtQvA== HTTP/1.1Host: www.lagrangewildliferemoval.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 192.0.78.24 192.0.78.24

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: AUTOMATTICUS AUTOMATTICUS
Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS
Source: Joe Sandbox View	ASN Name: EGIHOSTINGUS EGIHOSTINGUS

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /dxe/?oZN=7nbLudZHS&mdslXXV=s4725d3Oabb4GJPvvzs1NGtrQqdCSFbT14B5hiC+hEbCkkM6v8NMU0M9YHV7hr/JdwNsVvK8Ug== HTTP/1.1Host: www.philreid4cc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dxe/?mdslXXV=c1qXo+D3OeWS7aQwzsMJrh0J2W+ZcnXSIybZATOUAxrA4uZvd+OeJvPZ6sfOQ4L/XOcBlc02WQ==&oZN=7nbLudZHS HTTP/1.1Host: www.sectorulb.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dxe/?oZN=7nbLudZHS&mdslXXV=pSmvUx3Cd9o2ehLRUYmTuUG+rz67XAZoYuLBzxOhEanl5TCXMyweO2X8MqC68oVFQcjckZtQvA== HTTP/1.1Host: www.lagrangewildliferemoval.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.philreid4cc.com

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 May 2021 13:43:34 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

URLs found in memory or binary data

Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: TT.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: TT.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000002.596476580.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.361956304.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\TT.exe

Code function: 0_2_0040548D GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040548D

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000007.00000002.597321036.0000000002F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.392835395.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.393512483.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.595686544.00000000007C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.335739935.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.344692024.0000000003030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.597417500.0000000002F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.392976261.00000000005E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT.exe.3030000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.TT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT.exe.3030000.4.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000007.00000002.597321036.0000000002F60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.597321036.0000000002F60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.392835395.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.392835395.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.393512483.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.393512483.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.595686544.00000000007C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.595686544.00000000007C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.335739935.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.335739935.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.344692024.0000000003030000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.344692024.0000000003030000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.597417500.0000000002F90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.597417500.0000000002F90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.392976261.00000000005E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.392976261.00000000005E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.TT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.TT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.TT.exe.3030000.4.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.TT.exe.3030000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.TT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.TT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.TT.exe.3030000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.TT.exe.3030000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00419D60 NtCreateFile,		1_2_00419D60
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00419E10 NtReadFile,		1_2_00419E10
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00419E90 NtClose,		1_2_00419E90
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00419F40 NtAllocateVirtualMemory,		1_2_00419F40
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00419D5A NtCreateFile,		1_2_00419D5A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00419E0A NtReadFile,		1_2_00419E0A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00419E8A NtClose,		1_2_00419E8A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00419F3A NtAllocateVirtualMemory,		1_2_00419F3A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A998F0 NtReadVirtualMemory,LdrInitializeThunk,		1_2_00A998F0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99860 NtQuerySystemInformation,LdrInitializeThunk,		1_2_00A99860
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99840 NtDelayExecution,LdrInitializeThunk,		1_2_00A99840
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A999A0 NtCreateSection,LdrInitializeThunk,		1_2_00A999A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99910 NtAdjustPrivilegesToken,LdrInitializeThunk,		1_2_00A99910
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99A20 NtResumeThread,LdrInitializeThunk,		1_2_00A99A20
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99A00 NtProtectVirtualMemory,LdrInitializeThunk,		1_2_00A99A00
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99A50 NtCreateFile,LdrInitializeThunk,		1_2_00A99A50
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A995D0 NtClose,LdrInitializeThunk,		1_2_00A995D0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99540 NtReadFile,LdrInitializeThunk,		1_2_00A99540
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A996E0 NtFreeVirtualMemory,LdrInitializeThunk,		1_2_00A996E0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99660 NtAllocateVirtualMemory,LdrInitializeThunk,		1_2_00A99660
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A997A0 NtUnmapViewOfSection,LdrInitializeThunk,		1_2_00A997A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99780 NtMapViewOfSection,LdrInitializeThunk,		1_2_00A99780
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99710 NtQueryInformationToken,LdrInitializeThunk,		1_2_00A99710
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A998A0 NtWriteVirtualMemory,		1_2_00A998A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99820 NtEnumerateKey,		1_2_00A99820
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A9B040 NtSuspendThread,		1_2_00A9B040
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A999D0 NtCreateProcessEx,		1_2_00A999D0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99950 NtQueueApcThread,		1_2_00A99950
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99A80 NtOpenDirectoryObject,		1_2_00A99A80
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99A10 NtQuerySection,		1_2_00A99A10
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A9A3B0 NtGetContextThread,		1_2_00A9A3B0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99B00 NtSetValueKey,		1_2_00A99B00
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A995F0 NtQueryInformationFile,		1_2_00A995F0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99520 NtWaitForSingleObject,		1_2_00A99520
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A9AD30 NtSetContextThread,		1_2_00A9AD30
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99560 NtWriteFile,		1_2_00A99560
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A996D0 NtCreateKey,		1_2_00A996D0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99610 NtEnumerateValueKey,		1_2_00A99610
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99670 NtQueryInformationProcess,		1_2_00A99670
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99650 NtQueryValueKey,		1_2_00A99650
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99FE0 NtCreateMutant,		1_2_00A99FE0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99730 NtQueryVirtualMemory,		1_2_00A99730
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A9A710 NtOpenProcessToken,		1_2_00A9A710
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99760 NtOpenProcess,		1_2_00A99760
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A99770 NtSetInformationFile,		1_2_00A99770
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A9A770 NtOpenThread,		1_2_00A9A770
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_00419D60 NtCreateFile,		1_1_00419D60
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_00419E10 NtReadFile,		1_1_00419E10
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_00419E90 NtClose,		1_1_00419E90
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_00419F40 NtAllocateVirtualMemory,		1_1_00419F40
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_00419D5A NtCreateFile,		1_1_00419D5A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49840 NtDelayExecution,LdrInitializeThunk,		7_2_04D49840
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49860 NtQuerySystemInformation,LdrInitializeThunk,		7_2_04D49860
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D495D0 NtClose,LdrInitializeThunk,		7_2_04D495D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D499A0 NtCreateSection,LdrInitializeThunk,		7_2_04D499A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49540 NtReadFile,LdrInitializeThunk,		7_2_04D49540
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49910 NtAdjustPrivilegesToken,LdrInitializeThunk,		7_2_04D49910
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D496D0 NtCreateKey,LdrInitializeThunk,		7_2_04D496D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D496E0 NtFreeVirtualMemory,LdrInitializeThunk,		7_2_04D496E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49650 NtQueryValueKey,LdrInitializeThunk,		7_2_04D49650
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49A50 NtCreateFile,LdrInitializeThunk,		7_2_04D49A50
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49660 NtAllocateVirtualMemory,LdrInitializeThunk,		7_2_04D49660
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49FE0 NtCreateMutant,LdrInitializeThunk,		7_2_04D49FE0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49780 NtMapViewOfSection,LdrInitializeThunk,		7_2_04D49780
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49710 NtQueryInformationToken,LdrInitializeThunk,		7_2_04D49710
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D498F0 NtReadVirtualMemory,		7_2_04D498F0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D498A0 NtWriteVirtualMemory,		7_2_04D498A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D4B040 NtSuspendThread,		7_2_04D4B040
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49820 NtEnumerateKey,		7_2_04D49820
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D499D0 NtCreateProcessEx,		7_2_04D499D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D495F0 NtQueryInformationFile,		7_2_04D495F0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49950 NtQueueApcThread,		7_2_04D49950
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49560 NtWriteFile,		7_2_04D49560
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D4AD30 NtSetContextThread,		7_2_04D4AD30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49520 NtWaitForSingleObject,		7_2_04D49520
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49A80 NtOpenDirectoryObject,		7_2_04D49A80
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49670 NtQueryInformationProcess,		7_2_04D49670
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49610 NtEnumerateValueKey,		7_2_04D49610
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49A10 NtQuerySection,		7_2_04D49A10
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49A00 NtProtectVirtualMemory,		7_2_04D49A00
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49A20 NtResumeThread,		7_2_04D49A20
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D4A3B0 NtGetContextThread,		7_2_04D4A3B0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D497A0 NtUnmapViewOfSection,		7_2_04D497A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49770 NtSetInformationFile,		7_2_04D49770
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D4A770 NtOpenThread,		7_2_04D4A770
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49760 NtOpenProcess,		7_2_04D49760
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D4A710 NtOpenProcessToken,		7_2_04D4A710
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49B00 NtSetValueKey,		7_2_04D49B00
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D49730 NtQueryVirtualMemory,		7_2_04D49730
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007D9D60 NtCreateFile,		7_2_007D9D60
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007D9E10 NtReadFile,		7_2_007D9E10
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007D9E90 NtClose,		7_2_007D9E90
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007D9F40 NtAllocateVirtualMemory,		7_2_007D9F40
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007D9D5A NtCreateFile,		7_2_007D9D5A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007D9E0A NtReadFile,		7_2_007D9E0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007D9E8A NtClose,		7_2_007D9E8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007D9F3A NtAllocateVirtualMemory,		7_2_007D9F3A

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\TT.exe

Code function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403461

Detected potential crypto function

Source: C:\Users\user\Desktop\TT.exe	Code function: 0_2_00406925		0_2_00406925
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00401030		1_2_00401030
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041E1FC		1_2_0041E1FC
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041D260		1_2_0041D260
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041DA2A		1_2_0041DA2A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041BDC4		1_2_0041BDC4
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00402D90		1_2_00402D90
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00409E40		1_2_00409E40
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00409E3C		1_2_00409E3C
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041D6DF		1_2_0041D6DF
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041DFA3		1_2_0041DFA3
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00402FB0		1_2_00402FB0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A820A0		1_2_00A820A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B220A8		1_2_00B220A8
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6B090		1_2_00A6B090
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B228EC		1_2_00B228EC
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11002		1_2_00B11002
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A74120		1_2_00A74120
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5F900		1_2_00A5F900
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B222AE		1_2_00B222AE
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8EBB0		1_2_00A8EBB0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1DBD2		1_2_00B1DBD2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B22B28		1_2_00B22B28
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6841F		1_2_00A6841F
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1D466		1_2_00B1D466
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A82581		1_2_00A82581
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6D5E0		1_2_00A6D5E0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B225DD		1_2_00B225DD
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A50D20		1_2_00A50D20
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B22D07		1_2_00B22D07
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B21D55		1_2_00B21D55
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B22EF7		1_2_00B22EF7
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A76E30		1_2_00A76E30
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B21FF1		1_2_00B21FF1
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_00401030		1_1_00401030
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_0041E1FC		1_1_0041E1FC
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_0041D260		1_1_0041D260
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_0041DA2A		1_1_0041DA2A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_0041BDC4		1_1_0041BDC4
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_00402D90		1_1_00402D90
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_00409E40		1_1_00409E40
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD28EC		7_2_04DD28EC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1B090		7_2_04D1B090
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D320A0		7_2_04D320A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD20A8		7_2_04DD20A8
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DCD466		7_2_04DCD466
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1841F		7_2_04D1841F
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1002		7_2_04DC1002
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD25DD		7_2_04DD25DD
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1D5E0		7_2_04D1D5E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D32581		7_2_04D32581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD1D55		7_2_04DD1D55
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0F900		7_2_04D0F900
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD2D07		7_2_04DD2D07
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D00D20		7_2_04D00D20
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D24120		7_2_04D24120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD2EF7		7_2_04DD2EF7
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD22AE		7_2_04DD22AE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D26E30		7_2_04D26E30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DCDBD2		7_2_04DCDBD2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD1FF1		7_2_04DD1FF1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3EBB0		7_2_04D3EBB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD2B28		7_2_04DD2B28
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007DE1FC		7_2_007DE1FC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007DBDC4		7_2_007DBDC4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007C2D90		7_2_007C2D90
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007C9E40		7_2_007C9E40
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007C9E3C		7_2_007C9E3C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007C2FB0		7_2_007C2FB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007DDFA3		7_2_007DDFA3

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\TT.exe	Code function: String function: 00A5B150 appears 35 times
Source: C:\Windows\SysWOW64\msdt.exe	Code function: String function: 04D0B150 appears 35 times

Sample file is different than original file name gathered from version info

Source: TT.exe, 00000000.00000003.334832337.000000000333F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs TT.exe
Source: TT.exe, 00000001.00000002.396335168.0000000002810000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamemsdt.exej% vs TT.exe
Source: TT.exe, 00000001.00000002.393874457.0000000000B4F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs TT.exe

Uses 32bit PE files

Source: TT.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Yara signature match

Source: 00000007.00000002.597321036.0000000002F60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.597321036.0000000002F60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.392835395.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.392835395.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.393512483.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.393512483.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.595686544.00000000007C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.595686544.00000000007C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.335739935.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.335739935.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.344692024.0000000003030000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.344692024.0000000003030000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.597417500.0000000002F90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.597417500.0000000002F90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.392976261.00000000005E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.392976261.00000000005E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.TT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.TT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.TT.exe.3030000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.TT.exe.3030000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.TT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.TT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.TT.exe.3030000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.TT.exe.3030000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/4@4/3

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\TT.exe

Code function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403461

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\TT.exe

Code function: 0_2_0040473E GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040473E

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\TT.exe

Code function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar,

0_2_0040216B

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6312:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\TT.exe

File created: C:\Users\user\AppData\Local\Temp\nsj2C11.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: TT.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Users\user\Desktop\TT.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\TT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: TT.exe	Virustotal: Detection: 25%
Source: TT.exe	ReversingLabs: Detection: 40%

Sample reads its own file content

Source: C:\Users\user\Desktop\TT.exe

File read: C:\Users\user\Desktop\TT.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\TT.exe 'C:\Users\user\Desktop\TT.exe'
Source: C:\Users\user\Desktop\TT.exe	Process created: C:\Users\user\Desktop\TT.exe 'C:\Users\user\Desktop\TT.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\TT.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TT.exe	Process created: C:\Users\user\Desktop\TT.exe 'C:\Users\user\Desktop\TT.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\TT.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\TT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: TT.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.366025907.000000000DC20000.00000002.00000001.sdmp
Source:	Binary string: msdt.pdbGCTL source: TT.exe, 00000001.00000002.396335168.0000000002810000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: TT.exe, 00000000.00000003.331979334.0000000003060000.00000004.00000001.sdmp, TT.exe, 00000001.00000002.393874457.0000000000B4F000.00000040.00000001.sdmp, msdt.exe, 00000007.00000002.598843723.0000000004DFF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: TT.exe, msdt.exe
Source:	Binary string: msdt.pdb source: TT.exe, 00000001.00000002.396335168.0000000002810000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.366025907.000000000DC20000.00000002.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\TT.exe

Unpacked PE file: 1.2.TT.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041E560 push ss; ret		1_2_0041E569
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041CEB5 push eax; ret		1_2_0041CF08
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041CF6C push eax; ret		1_2_0041CF72
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041CF02 push eax; ret		1_2_0041CF08
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_0041CF0B push eax; ret		1_2_0041CF72
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AAD0D1 push ecx; ret		1_2_00AAD0E4
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_1_0041E560 push ss; ret		1_1_0041E569
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D5D0D1 push ecx; ret		7_2_04D5D0E4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007DE560 push ss; ret		7_2_007DE569
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007DCEB5 push eax; ret		7_2_007DCF08
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007DCF6C push eax; ret		7_2_007DCF72
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007DCF0B push eax; ret		7_2_007DCF72
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_007DCF02 push eax; ret		7_2_007DCF08

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\TT.exe

File created: C:\Users\user\AppData\Local\Temp\nse2C42.tmp\myx92o78208f0o.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x85 0x5E 0xEE

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\TT.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\TT.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TT.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe	RDTSC instruction interceptor: First address: 00000000007C98E4 second address: 00000000007C98EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe	RDTSC instruction interceptor: First address: 00000000007C9B5E second address: 00000000007C9B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\TT.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\TT.exe

Code function: 1_2_00409A90 rdtsc

1_2_00409A90

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 6768	Thread sleep count: 31 > 30			Jump to behavior
Source: C:\Windows\explorer.exe TID: 6768	Thread sleep time: -62000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\TT.exe	Code function: 0_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		0_2_004059F0
Source: C:\Users\user\Desktop\TT.exe	Code function: 0_2_0040659C FindFirstFileA,FindClose,		0_2_0040659C
Source: C:\Users\user\Desktop\TT.exe	Code function: 0_2_004027A1 FindFirstFileA,		0_2_004027A1

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000004.00000000.359286524.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000004.00000000.359206330.00000000083E9000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000004.00000000.360079783.0000000008684000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.359026970.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.355462929.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.354002009.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.359206330.00000000083E9000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000004.00000000.355462929.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.359026970.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000004.00000000.354002009.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.354002009.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.359026970.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000004.00000000.359286524.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000004.00000000.354002009.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 00000004.00000002.596476580.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Queries a list of all running processes

Source: C:\Users\user\Desktop\TT.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\TT.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\TT.exe

Code function: 1_2_00409A90 rdtsc

1_2_00409A90

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\TT.exe

Code function: 1_2_0040ACD0 LdrLoadDll,

1_2_0040ACD0

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\TT.exe	Code function: 0_2_10001000 mov eax, dword ptr fs:[00000030h]		0_2_10001000
Source: C:\Users\user\Desktop\TT.exe	Code function: 0_2_030216D8 mov eax, dword ptr fs:[00000030h]		0_2_030216D8
Source: C:\Users\user\Desktop\TT.exe	Code function: 0_2_030218F0 mov eax, dword ptr fs:[00000030h]		0_2_030218F0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A990AF mov eax, dword ptr fs:[00000030h]		1_2_00A990AF
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h]		1_2_00A820A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h]		1_2_00A820A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h]		1_2_00A820A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h]		1_2_00A820A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h]		1_2_00A820A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A820A0 mov eax, dword ptr fs:[00000030h]		1_2_00A820A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8F0BF mov ecx, dword ptr fs:[00000030h]		1_2_00A8F0BF
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8F0BF mov eax, dword ptr fs:[00000030h]		1_2_00A8F0BF
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8F0BF mov eax, dword ptr fs:[00000030h]		1_2_00A8F0BF
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A59080 mov eax, dword ptr fs:[00000030h]		1_2_00A59080
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD3884 mov eax, dword ptr fs:[00000030h]		1_2_00AD3884
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD3884 mov eax, dword ptr fs:[00000030h]		1_2_00AD3884
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A558EC mov eax, dword ptr fs:[00000030h]		1_2_00A558EC
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEB8D0 mov eax, dword ptr fs:[00000030h]		1_2_00AEB8D0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEB8D0 mov ecx, dword ptr fs:[00000030h]		1_2_00AEB8D0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEB8D0 mov eax, dword ptr fs:[00000030h]		1_2_00AEB8D0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEB8D0 mov eax, dword ptr fs:[00000030h]		1_2_00AEB8D0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEB8D0 mov eax, dword ptr fs:[00000030h]		1_2_00AEB8D0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEB8D0 mov eax, dword ptr fs:[00000030h]		1_2_00AEB8D0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8002D mov eax, dword ptr fs:[00000030h]		1_2_00A8002D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8002D mov eax, dword ptr fs:[00000030h]		1_2_00A8002D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8002D mov eax, dword ptr fs:[00000030h]		1_2_00A8002D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8002D mov eax, dword ptr fs:[00000030h]		1_2_00A8002D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8002D mov eax, dword ptr fs:[00000030h]		1_2_00A8002D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6B02A mov eax, dword ptr fs:[00000030h]		1_2_00A6B02A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6B02A mov eax, dword ptr fs:[00000030h]		1_2_00A6B02A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6B02A mov eax, dword ptr fs:[00000030h]		1_2_00A6B02A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6B02A mov eax, dword ptr fs:[00000030h]		1_2_00A6B02A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B24015 mov eax, dword ptr fs:[00000030h]		1_2_00B24015
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B24015 mov eax, dword ptr fs:[00000030h]		1_2_00B24015
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD7016 mov eax, dword ptr fs:[00000030h]		1_2_00AD7016
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD7016 mov eax, dword ptr fs:[00000030h]		1_2_00AD7016
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD7016 mov eax, dword ptr fs:[00000030h]		1_2_00AD7016
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B12073 mov eax, dword ptr fs:[00000030h]		1_2_00B12073
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B21074 mov eax, dword ptr fs:[00000030h]		1_2_00B21074
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A70050 mov eax, dword ptr fs:[00000030h]		1_2_00A70050
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A70050 mov eax, dword ptr fs:[00000030h]		1_2_00A70050
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A861A0 mov eax, dword ptr fs:[00000030h]		1_2_00A861A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A861A0 mov eax, dword ptr fs:[00000030h]		1_2_00A861A0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD69A6 mov eax, dword ptr fs:[00000030h]		1_2_00AD69A6
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD51BE mov eax, dword ptr fs:[00000030h]		1_2_00AD51BE
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD51BE mov eax, dword ptr fs:[00000030h]		1_2_00AD51BE
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD51BE mov eax, dword ptr fs:[00000030h]		1_2_00AD51BE
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD51BE mov eax, dword ptr fs:[00000030h]		1_2_00AD51BE
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7C182 mov eax, dword ptr fs:[00000030h]		1_2_00A7C182
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8A185 mov eax, dword ptr fs:[00000030h]		1_2_00A8A185
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A82990 mov eax, dword ptr fs:[00000030h]		1_2_00A82990
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5B1E1 mov eax, dword ptr fs:[00000030h]		1_2_00A5B1E1
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5B1E1 mov eax, dword ptr fs:[00000030h]		1_2_00A5B1E1
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5B1E1 mov eax, dword ptr fs:[00000030h]		1_2_00A5B1E1
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AE41E8 mov eax, dword ptr fs:[00000030h]		1_2_00AE41E8
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A74120 mov eax, dword ptr fs:[00000030h]		1_2_00A74120
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A74120 mov eax, dword ptr fs:[00000030h]		1_2_00A74120
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A74120 mov eax, dword ptr fs:[00000030h]		1_2_00A74120
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A74120 mov eax, dword ptr fs:[00000030h]		1_2_00A74120
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A74120 mov ecx, dword ptr fs:[00000030h]		1_2_00A74120
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8513A mov eax, dword ptr fs:[00000030h]		1_2_00A8513A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8513A mov eax, dword ptr fs:[00000030h]		1_2_00A8513A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A59100 mov eax, dword ptr fs:[00000030h]		1_2_00A59100
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A59100 mov eax, dword ptr fs:[00000030h]		1_2_00A59100
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A59100 mov eax, dword ptr fs:[00000030h]		1_2_00A59100
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5C962 mov eax, dword ptr fs:[00000030h]		1_2_00A5C962
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5B171 mov eax, dword ptr fs:[00000030h]		1_2_00A5B171
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5B171 mov eax, dword ptr fs:[00000030h]		1_2_00A5B171
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7B944 mov eax, dword ptr fs:[00000030h]		1_2_00A7B944
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7B944 mov eax, dword ptr fs:[00000030h]		1_2_00A7B944
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A552A5 mov eax, dword ptr fs:[00000030h]		1_2_00A552A5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A552A5 mov eax, dword ptr fs:[00000030h]		1_2_00A552A5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A552A5 mov eax, dword ptr fs:[00000030h]		1_2_00A552A5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A552A5 mov eax, dword ptr fs:[00000030h]		1_2_00A552A5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A552A5 mov eax, dword ptr fs:[00000030h]		1_2_00A552A5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6AAB0 mov eax, dword ptr fs:[00000030h]		1_2_00A6AAB0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6AAB0 mov eax, dword ptr fs:[00000030h]		1_2_00A6AAB0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8FAB0 mov eax, dword ptr fs:[00000030h]		1_2_00A8FAB0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8D294 mov eax, dword ptr fs:[00000030h]		1_2_00A8D294
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8D294 mov eax, dword ptr fs:[00000030h]		1_2_00A8D294
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A82AE4 mov eax, dword ptr fs:[00000030h]		1_2_00A82AE4
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A82ACB mov eax, dword ptr fs:[00000030h]		1_2_00A82ACB
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A94A2C mov eax, dword ptr fs:[00000030h]		1_2_00A94A2C
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A94A2C mov eax, dword ptr fs:[00000030h]		1_2_00A94A2C
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A68A0A mov eax, dword ptr fs:[00000030h]		1_2_00A68A0A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5AA16 mov eax, dword ptr fs:[00000030h]		1_2_00A5AA16
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5AA16 mov eax, dword ptr fs:[00000030h]		1_2_00A5AA16
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A55210 mov eax, dword ptr fs:[00000030h]		1_2_00A55210
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A55210 mov ecx, dword ptr fs:[00000030h]		1_2_00A55210
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A55210 mov eax, dword ptr fs:[00000030h]		1_2_00A55210
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A55210 mov eax, dword ptr fs:[00000030h]		1_2_00A55210
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A73A1C mov eax, dword ptr fs:[00000030h]		1_2_00A73A1C
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B0B260 mov eax, dword ptr fs:[00000030h]		1_2_00B0B260
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B0B260 mov eax, dword ptr fs:[00000030h]		1_2_00B0B260
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B28A62 mov eax, dword ptr fs:[00000030h]		1_2_00B28A62
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A9927A mov eax, dword ptr fs:[00000030h]		1_2_00A9927A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1EA55 mov eax, dword ptr fs:[00000030h]		1_2_00B1EA55
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A59240 mov eax, dword ptr fs:[00000030h]		1_2_00A59240
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A59240 mov eax, dword ptr fs:[00000030h]		1_2_00A59240
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A59240 mov eax, dword ptr fs:[00000030h]		1_2_00A59240
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A59240 mov eax, dword ptr fs:[00000030h]		1_2_00A59240
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AE4257 mov eax, dword ptr fs:[00000030h]		1_2_00AE4257
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A84BAD mov eax, dword ptr fs:[00000030h]		1_2_00A84BAD
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A84BAD mov eax, dword ptr fs:[00000030h]		1_2_00A84BAD
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A84BAD mov eax, dword ptr fs:[00000030h]		1_2_00A84BAD
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B25BA5 mov eax, dword ptr fs:[00000030h]		1_2_00B25BA5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A61B8F mov eax, dword ptr fs:[00000030h]		1_2_00A61B8F
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A61B8F mov eax, dword ptr fs:[00000030h]		1_2_00A61B8F
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B0D380 mov ecx, dword ptr fs:[00000030h]		1_2_00B0D380
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8B390 mov eax, dword ptr fs:[00000030h]		1_2_00A8B390
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1138A mov eax, dword ptr fs:[00000030h]		1_2_00B1138A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A82397 mov eax, dword ptr fs:[00000030h]		1_2_00A82397
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A803E2 mov eax, dword ptr fs:[00000030h]		1_2_00A803E2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A803E2 mov eax, dword ptr fs:[00000030h]		1_2_00A803E2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A803E2 mov eax, dword ptr fs:[00000030h]		1_2_00A803E2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A803E2 mov eax, dword ptr fs:[00000030h]		1_2_00A803E2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A803E2 mov eax, dword ptr fs:[00000030h]		1_2_00A803E2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A803E2 mov eax, dword ptr fs:[00000030h]		1_2_00A803E2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7DBE9 mov eax, dword ptr fs:[00000030h]		1_2_00A7DBE9
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD53CA mov eax, dword ptr fs:[00000030h]		1_2_00AD53CA
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD53CA mov eax, dword ptr fs:[00000030h]		1_2_00AD53CA
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1131B mov eax, dword ptr fs:[00000030h]		1_2_00B1131B
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5DB60 mov ecx, dword ptr fs:[00000030h]		1_2_00A5DB60
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A83B7A mov eax, dword ptr fs:[00000030h]		1_2_00A83B7A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A83B7A mov eax, dword ptr fs:[00000030h]		1_2_00A83B7A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5DB40 mov eax, dword ptr fs:[00000030h]		1_2_00A5DB40
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B28B58 mov eax, dword ptr fs:[00000030h]		1_2_00B28B58
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5F358 mov eax, dword ptr fs:[00000030h]		1_2_00A5F358
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6849B mov eax, dword ptr fs:[00000030h]		1_2_00A6849B
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B114FB mov eax, dword ptr fs:[00000030h]		1_2_00B114FB
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6CF0 mov eax, dword ptr fs:[00000030h]		1_2_00AD6CF0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6CF0 mov eax, dword ptr fs:[00000030h]		1_2_00AD6CF0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6CF0 mov eax, dword ptr fs:[00000030h]		1_2_00AD6CF0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B28CD6 mov eax, dword ptr fs:[00000030h]		1_2_00B28CD6
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8BC2C mov eax, dword ptr fs:[00000030h]		1_2_00A8BC2C
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6C0A mov eax, dword ptr fs:[00000030h]		1_2_00AD6C0A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6C0A mov eax, dword ptr fs:[00000030h]		1_2_00AD6C0A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6C0A mov eax, dword ptr fs:[00000030h]		1_2_00AD6C0A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6C0A mov eax, dword ptr fs:[00000030h]		1_2_00AD6C0A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11C06 mov eax, dword ptr fs:[00000030h]		1_2_00B11C06
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B2740D mov eax, dword ptr fs:[00000030h]		1_2_00B2740D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B2740D mov eax, dword ptr fs:[00000030h]		1_2_00B2740D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B2740D mov eax, dword ptr fs:[00000030h]		1_2_00B2740D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7746D mov eax, dword ptr fs:[00000030h]		1_2_00A7746D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8A44B mov eax, dword ptr fs:[00000030h]		1_2_00A8A44B
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEC450 mov eax, dword ptr fs:[00000030h]		1_2_00AEC450
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEC450 mov eax, dword ptr fs:[00000030h]		1_2_00AEC450
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A835A1 mov eax, dword ptr fs:[00000030h]		1_2_00A835A1
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A81DB5 mov eax, dword ptr fs:[00000030h]		1_2_00A81DB5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A81DB5 mov eax, dword ptr fs:[00000030h]		1_2_00A81DB5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A81DB5 mov eax, dword ptr fs:[00000030h]		1_2_00A81DB5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B205AC mov eax, dword ptr fs:[00000030h]		1_2_00B205AC
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B205AC mov eax, dword ptr fs:[00000030h]		1_2_00B205AC
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A82581 mov eax, dword ptr fs:[00000030h]		1_2_00A82581
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A82581 mov eax, dword ptr fs:[00000030h]		1_2_00A82581
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A82581 mov eax, dword ptr fs:[00000030h]		1_2_00A82581
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A82581 mov eax, dword ptr fs:[00000030h]		1_2_00A82581
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A52D8A mov eax, dword ptr fs:[00000030h]		1_2_00A52D8A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A52D8A mov eax, dword ptr fs:[00000030h]		1_2_00A52D8A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A52D8A mov eax, dword ptr fs:[00000030h]		1_2_00A52D8A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A52D8A mov eax, dword ptr fs:[00000030h]		1_2_00A52D8A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A52D8A mov eax, dword ptr fs:[00000030h]		1_2_00A52D8A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8FD9B mov eax, dword ptr fs:[00000030h]		1_2_00A8FD9B
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8FD9B mov eax, dword ptr fs:[00000030h]		1_2_00A8FD9B
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B08DF1 mov eax, dword ptr fs:[00000030h]		1_2_00B08DF1
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6D5E0 mov eax, dword ptr fs:[00000030h]		1_2_00A6D5E0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6D5E0 mov eax, dword ptr fs:[00000030h]		1_2_00A6D5E0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00B1FDE2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00B1FDE2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00B1FDE2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1FDE2 mov eax, dword ptr fs:[00000030h]		1_2_00B1FDE2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6DC9 mov eax, dword ptr fs:[00000030h]		1_2_00AD6DC9
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6DC9 mov eax, dword ptr fs:[00000030h]		1_2_00AD6DC9
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6DC9 mov eax, dword ptr fs:[00000030h]		1_2_00AD6DC9
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6DC9 mov ecx, dword ptr fs:[00000030h]		1_2_00AD6DC9
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6DC9 mov eax, dword ptr fs:[00000030h]		1_2_00AD6DC9
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD6DC9 mov eax, dword ptr fs:[00000030h]		1_2_00AD6DC9
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B28D34 mov eax, dword ptr fs:[00000030h]		1_2_00B28D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1E539 mov eax, dword ptr fs:[00000030h]		1_2_00B1E539
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A63D34 mov eax, dword ptr fs:[00000030h]		1_2_00A63D34
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A84D3B mov eax, dword ptr fs:[00000030h]		1_2_00A84D3B
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A84D3B mov eax, dword ptr fs:[00000030h]		1_2_00A84D3B
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A84D3B mov eax, dword ptr fs:[00000030h]		1_2_00A84D3B
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5AD30 mov eax, dword ptr fs:[00000030h]		1_2_00A5AD30
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00ADA537 mov eax, dword ptr fs:[00000030h]		1_2_00ADA537
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7C577 mov eax, dword ptr fs:[00000030h]		1_2_00A7C577
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7C577 mov eax, dword ptr fs:[00000030h]		1_2_00A7C577
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A93D43 mov eax, dword ptr fs:[00000030h]		1_2_00A93D43
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD3540 mov eax, dword ptr fs:[00000030h]		1_2_00AD3540
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A77D50 mov eax, dword ptr fs:[00000030h]		1_2_00A77D50
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD46A7 mov eax, dword ptr fs:[00000030h]		1_2_00AD46A7
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B20EA5 mov eax, dword ptr fs:[00000030h]		1_2_00B20EA5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B20EA5 mov eax, dword ptr fs:[00000030h]		1_2_00B20EA5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B20EA5 mov eax, dword ptr fs:[00000030h]		1_2_00B20EA5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEFE87 mov eax, dword ptr fs:[00000030h]		1_2_00AEFE87
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A676E2 mov eax, dword ptr fs:[00000030h]		1_2_00A676E2
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A816E0 mov ecx, dword ptr fs:[00000030h]		1_2_00A816E0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B28ED6 mov eax, dword ptr fs:[00000030h]		1_2_00B28ED6
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A836CC mov eax, dword ptr fs:[00000030h]		1_2_00A836CC
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A98EC7 mov eax, dword ptr fs:[00000030h]		1_2_00A98EC7
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B0FEC0 mov eax, dword ptr fs:[00000030h]		1_2_00B0FEC0
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5E620 mov eax, dword ptr fs:[00000030h]		1_2_00A5E620
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B0FE3F mov eax, dword ptr fs:[00000030h]		1_2_00B0FE3F
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5C600 mov eax, dword ptr fs:[00000030h]		1_2_00A5C600
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5C600 mov eax, dword ptr fs:[00000030h]		1_2_00A5C600
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A5C600 mov eax, dword ptr fs:[00000030h]		1_2_00A5C600
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A88E00 mov eax, dword ptr fs:[00000030h]		1_2_00A88E00
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8A61C mov eax, dword ptr fs:[00000030h]		1_2_00A8A61C
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8A61C mov eax, dword ptr fs:[00000030h]		1_2_00A8A61C
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B11608 mov eax, dword ptr fs:[00000030h]		1_2_00B11608
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6766D mov eax, dword ptr fs:[00000030h]		1_2_00A6766D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7AE73 mov eax, dword ptr fs:[00000030h]		1_2_00A7AE73
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7AE73 mov eax, dword ptr fs:[00000030h]		1_2_00A7AE73
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7AE73 mov eax, dword ptr fs:[00000030h]		1_2_00A7AE73
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7AE73 mov eax, dword ptr fs:[00000030h]		1_2_00A7AE73
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7AE73 mov eax, dword ptr fs:[00000030h]		1_2_00A7AE73
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A67E41 mov eax, dword ptr fs:[00000030h]		1_2_00A67E41
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A67E41 mov eax, dword ptr fs:[00000030h]		1_2_00A67E41
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A67E41 mov eax, dword ptr fs:[00000030h]		1_2_00A67E41
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A67E41 mov eax, dword ptr fs:[00000030h]		1_2_00A67E41
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A67E41 mov eax, dword ptr fs:[00000030h]		1_2_00A67E41
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A67E41 mov eax, dword ptr fs:[00000030h]		1_2_00A67E41
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1AE44 mov eax, dword ptr fs:[00000030h]		1_2_00B1AE44
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B1AE44 mov eax, dword ptr fs:[00000030h]		1_2_00B1AE44
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A68794 mov eax, dword ptr fs:[00000030h]		1_2_00A68794
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD7794 mov eax, dword ptr fs:[00000030h]		1_2_00AD7794
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD7794 mov eax, dword ptr fs:[00000030h]		1_2_00AD7794
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AD7794 mov eax, dword ptr fs:[00000030h]		1_2_00AD7794
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A937F5 mov eax, dword ptr fs:[00000030h]		1_2_00A937F5
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A54F2E mov eax, dword ptr fs:[00000030h]		1_2_00A54F2E
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A54F2E mov eax, dword ptr fs:[00000030h]		1_2_00A54F2E
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8E730 mov eax, dword ptr fs:[00000030h]		1_2_00A8E730
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8A70E mov eax, dword ptr fs:[00000030h]		1_2_00A8A70E
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A8A70E mov eax, dword ptr fs:[00000030h]		1_2_00A8A70E
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A7F716 mov eax, dword ptr fs:[00000030h]		1_2_00A7F716
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEFF10 mov eax, dword ptr fs:[00000030h]		1_2_00AEFF10
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00AEFF10 mov eax, dword ptr fs:[00000030h]		1_2_00AEFF10
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B2070D mov eax, dword ptr fs:[00000030h]		1_2_00B2070D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B2070D mov eax, dword ptr fs:[00000030h]		1_2_00B2070D
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6FF60 mov eax, dword ptr fs:[00000030h]		1_2_00A6FF60
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00B28F6A mov eax, dword ptr fs:[00000030h]		1_2_00B28F6A
Source: C:\Users\user\Desktop\TT.exe	Code function: 1_2_00A6EF40 mov eax, dword ptr fs:[00000030h]		1_2_00A6EF40
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D9B8D0 mov eax, dword ptr fs:[00000030h]		7_2_04D9B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D9B8D0 mov ecx, dword ptr fs:[00000030h]		7_2_04D9B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D9B8D0 mov eax, dword ptr fs:[00000030h]		7_2_04D9B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D9B8D0 mov eax, dword ptr fs:[00000030h]		7_2_04D9B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D9B8D0 mov eax, dword ptr fs:[00000030h]		7_2_04D9B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D9B8D0 mov eax, dword ptr fs:[00000030h]		7_2_04D9B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD8CD6 mov eax, dword ptr fs:[00000030h]		7_2_04DD8CD6
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC14FB mov eax, dword ptr fs:[00000030h]		7_2_04DC14FB
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86CF0 mov eax, dword ptr fs:[00000030h]		7_2_04D86CF0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86CF0 mov eax, dword ptr fs:[00000030h]		7_2_04D86CF0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86CF0 mov eax, dword ptr fs:[00000030h]		7_2_04D86CF0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D058EC mov eax, dword ptr fs:[00000030h]		7_2_04D058EC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1849B mov eax, dword ptr fs:[00000030h]		7_2_04D1849B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D09080 mov eax, dword ptr fs:[00000030h]		7_2_04D09080
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D83884 mov eax, dword ptr fs:[00000030h]		7_2_04D83884
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D83884 mov eax, dword ptr fs:[00000030h]		7_2_04D83884
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3F0BF mov ecx, dword ptr fs:[00000030h]		7_2_04D3F0BF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3F0BF mov eax, dword ptr fs:[00000030h]		7_2_04D3F0BF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3F0BF mov eax, dword ptr fs:[00000030h]		7_2_04D3F0BF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D320A0 mov eax, dword ptr fs:[00000030h]		7_2_04D320A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D320A0 mov eax, dword ptr fs:[00000030h]		7_2_04D320A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D320A0 mov eax, dword ptr fs:[00000030h]		7_2_04D320A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D320A0 mov eax, dword ptr fs:[00000030h]		7_2_04D320A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D320A0 mov eax, dword ptr fs:[00000030h]		7_2_04D320A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D320A0 mov eax, dword ptr fs:[00000030h]		7_2_04D320A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D490AF mov eax, dword ptr fs:[00000030h]		7_2_04D490AF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D20050 mov eax, dword ptr fs:[00000030h]		7_2_04D20050
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D20050 mov eax, dword ptr fs:[00000030h]		7_2_04D20050
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D9C450 mov eax, dword ptr fs:[00000030h]		7_2_04D9C450
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D9C450 mov eax, dword ptr fs:[00000030h]		7_2_04D9C450
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3A44B mov eax, dword ptr fs:[00000030h]		7_2_04D3A44B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD1074 mov eax, dword ptr fs:[00000030h]		7_2_04DD1074
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC2073 mov eax, dword ptr fs:[00000030h]		7_2_04DC2073
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2746D mov eax, dword ptr fs:[00000030h]		7_2_04D2746D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD4015 mov eax, dword ptr fs:[00000030h]		7_2_04DD4015
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD4015 mov eax, dword ptr fs:[00000030h]		7_2_04DD4015
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D87016 mov eax, dword ptr fs:[00000030h]		7_2_04D87016
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D87016 mov eax, dword ptr fs:[00000030h]		7_2_04D87016
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D87016 mov eax, dword ptr fs:[00000030h]		7_2_04D87016
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD740D mov eax, dword ptr fs:[00000030h]		7_2_04DD740D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD740D mov eax, dword ptr fs:[00000030h]		7_2_04DD740D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD740D mov eax, dword ptr fs:[00000030h]		7_2_04DD740D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86C0A mov eax, dword ptr fs:[00000030h]		7_2_04D86C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86C0A mov eax, dword ptr fs:[00000030h]		7_2_04D86C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86C0A mov eax, dword ptr fs:[00000030h]		7_2_04D86C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86C0A mov eax, dword ptr fs:[00000030h]		7_2_04D86C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1C06 mov eax, dword ptr fs:[00000030h]		7_2_04DC1C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1B02A mov eax, dword ptr fs:[00000030h]		7_2_04D1B02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1B02A mov eax, dword ptr fs:[00000030h]		7_2_04D1B02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1B02A mov eax, dword ptr fs:[00000030h]		7_2_04D1B02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1B02A mov eax, dword ptr fs:[00000030h]		7_2_04D1B02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3002D mov eax, dword ptr fs:[00000030h]		7_2_04D3002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3002D mov eax, dword ptr fs:[00000030h]		7_2_04D3002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3002D mov eax, dword ptr fs:[00000030h]		7_2_04D3002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3002D mov eax, dword ptr fs:[00000030h]		7_2_04D3002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3002D mov eax, dword ptr fs:[00000030h]		7_2_04D3002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3BC2C mov eax, dword ptr fs:[00000030h]		7_2_04D3BC2C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86DC9 mov eax, dword ptr fs:[00000030h]		7_2_04D86DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86DC9 mov eax, dword ptr fs:[00000030h]		7_2_04D86DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86DC9 mov eax, dword ptr fs:[00000030h]		7_2_04D86DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86DC9 mov ecx, dword ptr fs:[00000030h]		7_2_04D86DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86DC9 mov eax, dword ptr fs:[00000030h]		7_2_04D86DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D86DC9 mov eax, dword ptr fs:[00000030h]		7_2_04D86DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DB8DF1 mov eax, dword ptr fs:[00000030h]		7_2_04DB8DF1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0B1E1 mov eax, dword ptr fs:[00000030h]		7_2_04D0B1E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0B1E1 mov eax, dword ptr fs:[00000030h]		7_2_04D0B1E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0B1E1 mov eax, dword ptr fs:[00000030h]		7_2_04D0B1E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D941E8 mov eax, dword ptr fs:[00000030h]		7_2_04D941E8
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1D5E0 mov eax, dword ptr fs:[00000030h]		7_2_04D1D5E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1D5E0 mov eax, dword ptr fs:[00000030h]		7_2_04D1D5E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DCFDE2 mov eax, dword ptr fs:[00000030h]		7_2_04DCFDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DCFDE2 mov eax, dword ptr fs:[00000030h]		7_2_04DCFDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DCFDE2 mov eax, dword ptr fs:[00000030h]		7_2_04DCFDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DCFDE2 mov eax, dword ptr fs:[00000030h]		7_2_04DCFDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D32990 mov eax, dword ptr fs:[00000030h]		7_2_04D32990
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3FD9B mov eax, dword ptr fs:[00000030h]		7_2_04D3FD9B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3FD9B mov eax, dword ptr fs:[00000030h]		7_2_04D3FD9B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2C182 mov eax, dword ptr fs:[00000030h]		7_2_04D2C182
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D32581 mov eax, dword ptr fs:[00000030h]		7_2_04D32581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D32581 mov eax, dword ptr fs:[00000030h]		7_2_04D32581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D32581 mov eax, dword ptr fs:[00000030h]		7_2_04D32581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D32581 mov eax, dword ptr fs:[00000030h]		7_2_04D32581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3A185 mov eax, dword ptr fs:[00000030h]		7_2_04D3A185
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D02D8A mov eax, dword ptr fs:[00000030h]		7_2_04D02D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D02D8A mov eax, dword ptr fs:[00000030h]		7_2_04D02D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D02D8A mov eax, dword ptr fs:[00000030h]		7_2_04D02D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D02D8A mov eax, dword ptr fs:[00000030h]		7_2_04D02D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D02D8A mov eax, dword ptr fs:[00000030h]		7_2_04D02D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D31DB5 mov eax, dword ptr fs:[00000030h]		7_2_04D31DB5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D31DB5 mov eax, dword ptr fs:[00000030h]		7_2_04D31DB5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D31DB5 mov eax, dword ptr fs:[00000030h]		7_2_04D31DB5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D851BE mov eax, dword ptr fs:[00000030h]		7_2_04D851BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D851BE mov eax, dword ptr fs:[00000030h]		7_2_04D851BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D851BE mov eax, dword ptr fs:[00000030h]		7_2_04D851BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D851BE mov eax, dword ptr fs:[00000030h]		7_2_04D851BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD05AC mov eax, dword ptr fs:[00000030h]		7_2_04DD05AC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD05AC mov eax, dword ptr fs:[00000030h]		7_2_04DD05AC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D335A1 mov eax, dword ptr fs:[00000030h]		7_2_04D335A1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D361A0 mov eax, dword ptr fs:[00000030h]		7_2_04D361A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D361A0 mov eax, dword ptr fs:[00000030h]		7_2_04D361A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D869A6 mov eax, dword ptr fs:[00000030h]		7_2_04D869A6
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D27D50 mov eax, dword ptr fs:[00000030h]		7_2_04D27D50
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2B944 mov eax, dword ptr fs:[00000030h]		7_2_04D2B944
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2B944 mov eax, dword ptr fs:[00000030h]		7_2_04D2B944
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D43D43 mov eax, dword ptr fs:[00000030h]		7_2_04D43D43
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D83540 mov eax, dword ptr fs:[00000030h]		7_2_04D83540
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0B171 mov eax, dword ptr fs:[00000030h]		7_2_04D0B171
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0B171 mov eax, dword ptr fs:[00000030h]		7_2_04D0B171
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2C577 mov eax, dword ptr fs:[00000030h]		7_2_04D2C577
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2C577 mov eax, dword ptr fs:[00000030h]		7_2_04D2C577
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0C962 mov eax, dword ptr fs:[00000030h]		7_2_04D0C962
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D09100 mov eax, dword ptr fs:[00000030h]		7_2_04D09100
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D09100 mov eax, dword ptr fs:[00000030h]		7_2_04D09100
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D09100 mov eax, dword ptr fs:[00000030h]		7_2_04D09100
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0AD30 mov eax, dword ptr fs:[00000030h]		7_2_04D0AD30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D13D34 mov eax, dword ptr fs:[00000030h]		7_2_04D13D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DCE539 mov eax, dword ptr fs:[00000030h]		7_2_04DCE539
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D34D3B mov eax, dword ptr fs:[00000030h]		7_2_04D34D3B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D34D3B mov eax, dword ptr fs:[00000030h]		7_2_04D34D3B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D34D3B mov eax, dword ptr fs:[00000030h]		7_2_04D34D3B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD8D34 mov eax, dword ptr fs:[00000030h]		7_2_04DD8D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3513A mov eax, dword ptr fs:[00000030h]		7_2_04D3513A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3513A mov eax, dword ptr fs:[00000030h]		7_2_04D3513A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D8A537 mov eax, dword ptr fs:[00000030h]		7_2_04D8A537
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D24120 mov eax, dword ptr fs:[00000030h]		7_2_04D24120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D24120 mov eax, dword ptr fs:[00000030h]		7_2_04D24120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D24120 mov eax, dword ptr fs:[00000030h]		7_2_04D24120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D24120 mov eax, dword ptr fs:[00000030h]		7_2_04D24120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D24120 mov ecx, dword ptr fs:[00000030h]		7_2_04D24120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD8ED6 mov eax, dword ptr fs:[00000030h]		7_2_04DD8ED6
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D48EC7 mov eax, dword ptr fs:[00000030h]		7_2_04D48EC7
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D32ACB mov eax, dword ptr fs:[00000030h]		7_2_04D32ACB
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DBFEC0 mov eax, dword ptr fs:[00000030h]		7_2_04DBFEC0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D336CC mov eax, dword ptr fs:[00000030h]		7_2_04D336CC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D316E0 mov ecx, dword ptr fs:[00000030h]		7_2_04D316E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D176E2 mov eax, dword ptr fs:[00000030h]		7_2_04D176E2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D32AE4 mov eax, dword ptr fs:[00000030h]		7_2_04D32AE4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3D294 mov eax, dword ptr fs:[00000030h]		7_2_04D3D294
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3D294 mov eax, dword ptr fs:[00000030h]		7_2_04D3D294
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D9FE87 mov eax, dword ptr fs:[00000030h]		7_2_04D9FE87
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1AAB0 mov eax, dword ptr fs:[00000030h]		7_2_04D1AAB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1AAB0 mov eax, dword ptr fs:[00000030h]		7_2_04D1AAB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3FAB0 mov eax, dword ptr fs:[00000030h]		7_2_04D3FAB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D052A5 mov eax, dword ptr fs:[00000030h]		7_2_04D052A5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D052A5 mov eax, dword ptr fs:[00000030h]		7_2_04D052A5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D052A5 mov eax, dword ptr fs:[00000030h]		7_2_04D052A5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D052A5 mov eax, dword ptr fs:[00000030h]		7_2_04D052A5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D052A5 mov eax, dword ptr fs:[00000030h]		7_2_04D052A5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD0EA5 mov eax, dword ptr fs:[00000030h]		7_2_04DD0EA5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD0EA5 mov eax, dword ptr fs:[00000030h]		7_2_04DD0EA5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD0EA5 mov eax, dword ptr fs:[00000030h]		7_2_04DD0EA5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D846A7 mov eax, dword ptr fs:[00000030h]		7_2_04D846A7
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DCEA55 mov eax, dword ptr fs:[00000030h]		7_2_04DCEA55
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D94257 mov eax, dword ptr fs:[00000030h]		7_2_04D94257
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D09240 mov eax, dword ptr fs:[00000030h]		7_2_04D09240
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D09240 mov eax, dword ptr fs:[00000030h]		7_2_04D09240
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D09240 mov eax, dword ptr fs:[00000030h]		7_2_04D09240
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D09240 mov eax, dword ptr fs:[00000030h]		7_2_04D09240
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D17E41 mov eax, dword ptr fs:[00000030h]		7_2_04D17E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D17E41 mov eax, dword ptr fs:[00000030h]		7_2_04D17E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D17E41 mov eax, dword ptr fs:[00000030h]		7_2_04D17E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D17E41 mov eax, dword ptr fs:[00000030h]		7_2_04D17E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D17E41 mov eax, dword ptr fs:[00000030h]		7_2_04D17E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D17E41 mov eax, dword ptr fs:[00000030h]		7_2_04D17E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DCAE44 mov eax, dword ptr fs:[00000030h]		7_2_04DCAE44
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DCAE44 mov eax, dword ptr fs:[00000030h]		7_2_04DCAE44
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2AE73 mov eax, dword ptr fs:[00000030h]		7_2_04D2AE73
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2AE73 mov eax, dword ptr fs:[00000030h]		7_2_04D2AE73
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2AE73 mov eax, dword ptr fs:[00000030h]		7_2_04D2AE73
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2AE73 mov eax, dword ptr fs:[00000030h]		7_2_04D2AE73
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2AE73 mov eax, dword ptr fs:[00000030h]		7_2_04D2AE73
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D4927A mov eax, dword ptr fs:[00000030h]		7_2_04D4927A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DBB260 mov eax, dword ptr fs:[00000030h]		7_2_04DBB260
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DBB260 mov eax, dword ptr fs:[00000030h]		7_2_04DBB260
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D1766D mov eax, dword ptr fs:[00000030h]		7_2_04D1766D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DD8A62 mov eax, dword ptr fs:[00000030h]		7_2_04DD8A62
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D05210 mov eax, dword ptr fs:[00000030h]		7_2_04D05210
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D05210 mov ecx, dword ptr fs:[00000030h]		7_2_04D05210
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D05210 mov eax, dword ptr fs:[00000030h]		7_2_04D05210
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D05210 mov eax, dword ptr fs:[00000030h]		7_2_04D05210
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0AA16 mov eax, dword ptr fs:[00000030h]		7_2_04D0AA16
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0AA16 mov eax, dword ptr fs:[00000030h]		7_2_04D0AA16
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D23A1C mov eax, dword ptr fs:[00000030h]		7_2_04D23A1C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3A61C mov eax, dword ptr fs:[00000030h]		7_2_04D3A61C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3A61C mov eax, dword ptr fs:[00000030h]		7_2_04D3A61C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0C600 mov eax, dword ptr fs:[00000030h]		7_2_04D0C600
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0C600 mov eax, dword ptr fs:[00000030h]		7_2_04D0C600
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0C600 mov eax, dword ptr fs:[00000030h]		7_2_04D0C600
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D38E00 mov eax, dword ptr fs:[00000030h]		7_2_04D38E00
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DC1608 mov eax, dword ptr fs:[00000030h]		7_2_04DC1608
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D18A0A mov eax, dword ptr fs:[00000030h]		7_2_04D18A0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04DBFE3F mov eax, dword ptr fs:[00000030h]		7_2_04DBFE3F
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D0E620 mov eax, dword ptr fs:[00000030h]		7_2_04D0E620
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D44A2C mov eax, dword ptr fs:[00000030h]		7_2_04D44A2C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D44A2C mov eax, dword ptr fs:[00000030h]		7_2_04D44A2C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D853CA mov eax, dword ptr fs:[00000030h]		7_2_04D853CA
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D853CA mov eax, dword ptr fs:[00000030h]		7_2_04D853CA
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D437F5 mov eax, dword ptr fs:[00000030h]		7_2_04D437F5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D303E2 mov eax, dword ptr fs:[00000030h]		7_2_04D303E2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D303E2 mov eax, dword ptr fs:[00000030h]		7_2_04D303E2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D303E2 mov eax, dword ptr fs:[00000030h]		7_2_04D303E2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D303E2 mov eax, dword ptr fs:[00000030h]		7_2_04D303E2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D303E2 mov eax, dword ptr fs:[00000030h]		7_2_04D303E2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D303E2 mov eax, dword ptr fs:[00000030h]		7_2_04D303E2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D2DBE9 mov eax, dword ptr fs:[00000030h]		7_2_04D2DBE9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D3B390 mov eax, dword ptr fs:[00000030h]		7_2_04D3B390
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D32397 mov eax, dword ptr fs:[00000030h]		7_2_04D32397
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04D18794 mov eax, dword ptr fs:[00000030h]		7_2_04D18794

Enables debug privileges

Source: C:\Users\user\Desktop\TT.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\TT.exe

Code function: 0_2_10001464 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_10001464

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.philreid4cc.com
Source: C:\Windows\explorer.exe	Network Connect: 192.0.78.24 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.lagrangewildliferemoval.com
Source: C:\Windows\explorer.exe	Network Connect: 107.180.41.236 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.sectorulb.com
Source: C:\Windows\explorer.exe	Network Connect: 107.165.149.13 80			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\TT.exe	Section loaded: unknown target: C:\Users\user\Desktop\TT.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\TT.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\TT.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\TT.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\TT.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\TT.exe	Thread register set: target process: 3440			Jump to behavior
Source: C:\Users\user\Desktop\TT.exe	Thread register set: target process: 3440			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Thread register set: target process: 3440			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\TT.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\TT.exe

Section unmapped: C:\Windows\SysWOW64\msdt.exe base address: B20000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\TT.exe	Process created: C:\Users\user\Desktop\TT.exe 'C:\Users\user\Desktop\TT.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\TT.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000004.00000000.340378838.0000000000EE0000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.597591476.0000000003390000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.596305048.00000000008B8000.00000004.00000020.sdmp, msdt.exe, 00000007.00000002.597591476.0000000003390000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.340378838.0000000000EE0000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.597591476.0000000003390000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000004.00000000.340378838.0000000000EE0000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.597591476.0000000003390000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query windows version

Source: C:\Users\user\Desktop\TT.exe

Code function: 0_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403461

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000007.00000002.597321036.0000000002F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.392835395.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.393512483.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.595686544.00000000007C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.335739935.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.344692024.0000000003030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.597417500.0000000002F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.392976261.00000000005E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT.exe.3030000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.TT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT.exe.3030000.4.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000007.00000002.597321036.0000000002F60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.392835395.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.393512483.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.595686544.00000000007C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.335739935.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.344692024.0000000003030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.597417500.0000000002F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.392976261.00000000005E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT.exe.3030000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.TT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.TT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT.exe.3030000.4.unpack, type: UNPACKEDPE