Windows Analysis Report PI-0387991.exe

Overview

General Information

Sample Name: PI-0387991.exe
Analysis ID: 452542
MD5: 655318bec9b30d5a2f2dedf399d87438
SHA1: 23f37c9bddcd8393f499fee9b77220765288020c
SHA256: 8cd1a5c6360cc1c0e513d4cc39f649bcb33b61c47c4b498b992ea8e9a41a48cd
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.bodymoisturizer.online/q4kr/"], "decoy": ["realmodapk.com", "hanoharuka.com", "shivalikspiritualproducts.com", "womenshealthclinincagra.com", "racketpark.com", "startuporig.com", "azkachinas.com", "klanblog.com", "linuxradio.tools", "siteoficial-liquida.com", "glsbuyer.com", "bestdeez.com", "teens2cash.com", "valleyviewconstruct.com", "myfortniteskins.com", "cambecare.com", "csec2011.com", "idookap.com", "warmwallsrecords.com", "smartmirror.one", "alertreels.com", "oiop.online", "61cratoslot.com", "hispanicassoclv.com", "pennyforyourprep.com", "fayansistanbul.com", "superbartendergigs.club", "herr-nourimann.com", "oatkc.net", "romahony.com", "sportcrea.com", "crystalnieblas.com", "lcmet.com", "nwaymyatthu-mm.com", "edsufferen.club", "apispotlight.com", "shadowcatrecording.com", "capwisefin.com", "themesinsider.com", "kadrisells.com", "db-82.com", "rentyoursubmarine.com", "rin-ronshop.com", "donzfamilia.com", "loyalcollegeofart.com", "socialize.site", "shadesailstructure.com", "smcenterbiz.com", "zcdonghua.com", "1420radiolider.com", "ckenpo.com", "trucksitasa.com", "getthistle.com", "usvisanicaragua.com", "josiemaxwrites.com", "dehaagennutraceuticals.com", "noiaapp.com", "blinbins.com", "getreitive.com", "turmericbar.com", "manifestwealthrightnow.com", "garagekuhn.com", "longviewfinancialadvisor.com", "hallworthcapital.com"]}
Multi AV Scanner detection for submitted file
Source: PI-0387991.exe Virustotal: Detection: 50% Perma Link
Source: PI-0387991.exe ReversingLabs: Detection: 43%
Yara detected FormBook
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY
Machine Learning detection for sample
Source: PI-0387991.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 8.2.RegSvcs.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: PI-0387991.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: PI-0387991.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: explorer.pdbUGP source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000009.00000000.342044175.0000000006FE0000.00000002.00000001.sdmp
Source: Binary string: RegSvcs.pdb, source: explorer.exe, 0000000A.00000002.501905978.0000000005AE7000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, explorer.exe, 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, explorer.exe
Source: Binary string: explorer.pdb source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp
Source: Binary string: RegSvcs.pdb source: explorer.exe, 0000000A.00000002.501905978.0000000005AE7000.00000004.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000009.00000000.342044175.0000000006FE0000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4x nop then pop edi 8_2_004162D8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 4x nop then pop edi 10_2_033A62D8

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49696 -> 162.241.2.50:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49696 -> 162.241.2.50:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49696 -> 162.241.2.50:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.bodymoisturizer.online/q4kr/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=stDcKtJiFThdGrRpndYyQbsbrCSX1QkCWnDTnTci+riMDIV/FP53rWURHHZjowo3ayyv HTTP/1.1Host: www.romahony.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=8Twh4s36gZRno0YiIaK1Aog0Jq5SRxj1tGC/kNtcN6cj6UbdIOqmSeR7M7wA7kAlsS0+ HTTP/1.1Host: www.idookap.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /q4kr/?KdPxHVdh=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq72D06e9ENr&m4z=hZWT6D HTTP/1.1Host: www.siteoficial-liquida.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=+adpk/1z85ABQgFM8KoV7nh2RN9wNRyN3NacL4PKZthW2WB1UYKLVSKaUBe2HmITnYf8 HTTP/1.1Host: www.hispanicassoclv.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WEST263GO-HKWest263InternationalLimitedHK WEST263GO-HKWest263InternationalLimitedHK
Source: Joe Sandbox View ASN Name: OIS1US OIS1US
Source: global traffic HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=stDcKtJiFThdGrRpndYyQbsbrCSX1QkCWnDTnTci+riMDIV/FP53rWURHHZjowo3ayyv HTTP/1.1Host: www.romahony.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=8Twh4s36gZRno0YiIaK1Aog0Jq5SRxj1tGC/kNtcN6cj6UbdIOqmSeR7M7wA7kAlsS0+ HTTP/1.1Host: www.idookap.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /q4kr/?KdPxHVdh=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq72D06e9ENr&m4z=hZWT6D HTTP/1.1Host: www.siteoficial-liquida.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=+adpk/1z85ABQgFM8KoV7nh2RN9wNRyN3NacL4PKZthW2WB1UYKLVSKaUBe2HmITnYf8 HTTP/1.1Host: www.hispanicassoclv.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.romahony.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 22 Jul 2021 13:06:49 GMTServer: Apache/2.4.41 (Ubuntu)Status: 404 Not FoundVary: Accept-Encodingreferer: http://image.baidu.comContent-Length: 0Connection: closeContent-Type: text/html;charset=utf-8;
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PI-0387991.exe, 00000000.00000003.235322005.0000000005F7E000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: PI-0387991.exe, 00000000.00000003.235286861.0000000005F7E000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comUfee
Source: PI-0387991.exe, 00000000.00000003.235173657.0000000005F7E000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com_f
Source: PI-0387991.exe, 00000000.00000003.235173657.0000000005F7E000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.come
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: PI-0387991.exe, 00000000.00000003.235286861.0000000005F7E000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.como.
Source: PI-0387991.exe, 00000000.00000003.235106286.0000000001A0C000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comporFxlei
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: PI-0387991.exe, 00000000.00000003.239980062.0000000001A0B000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/de
Source: explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: PI-0387991.exe, 00000000.00000003.320350638.0000000005F50000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: PI-0387991.exe, 00000000.00000003.320350638.0000000005F50000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comt
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: PI-0387991.exe, 00000000.00000003.234500396.0000000005F7E000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn-i-d)
Source: PI-0387991.exe, 00000000.00000003.234373089.0000000005F7B000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PI-0387991.exe, 00000000.00000003.243163796.0000000005F5B000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm3
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp, PI-0387991.exe, 00000000.00000003.236602049.0000000005F5B000.00000004.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/)
Source: PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: PI-0387991.exe, 00000000.00000003.236914102.0000000005F5B000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/f
Source: PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: PI-0387991.exe, 00000000.00000003.236232775.0000000005F53000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/)
Source: PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/7
Source: PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/k-e
Source: PI-0387991.exe, 00000000.00000003.235849740.0000000005F53000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/oil
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, PI-0387991.exe, 00000000.00000003.232499400.0000000001A0C000.00000004.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: PI-0387991.exe, 00000000.00000003.232499400.0000000001A0C000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.comd
Source: PI-0387991.exe, 00000000.00000003.232499400.0000000001A0C000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.comx
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: PI-0387991.exe, 00000000.00000003.234687612.0000000005F5B000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com~
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: PI-0387991.exe, 00000000.00000003.234998306.0000000005F7D000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cne
Source: PI-0387991.exe, 00000000.00000003.235106286.0000000001A0C000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cnobt

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004181D0 NtCreateFile, 8_2_004181D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00418280 NtReadFile, 8_2_00418280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00418300 NtClose, 8_2_00418300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004183B0 NtAllocateVirtualMemory, 8_2_004183B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004181CD NtCreateFile, 8_2_004181CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004182FA NtClose, 8_2_004182FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004183AA NtAllocateVirtualMemory, 8_2_004183AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329910 NtAdjustPrivilegesToken,LdrInitializeThunk, 8_2_01329910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013299A0 NtCreateSection,LdrInitializeThunk, 8_2_013299A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329860 NtQuerySystemInformation,LdrInitializeThunk, 8_2_01329860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329840 NtDelayExecution,LdrInitializeThunk, 8_2_01329840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013298F0 NtReadVirtualMemory,LdrInitializeThunk, 8_2_013298F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329A20 NtResumeThread,LdrInitializeThunk, 8_2_01329A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329A00 NtProtectVirtualMemory,LdrInitializeThunk, 8_2_01329A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329A50 NtCreateFile,LdrInitializeThunk, 8_2_01329A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329540 NtReadFile,LdrInitializeThunk, 8_2_01329540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013295D0 NtClose,LdrInitializeThunk, 8_2_013295D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329710 NtQueryInformationToken,LdrInitializeThunk, 8_2_01329710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013297A0 NtUnmapViewOfSection,LdrInitializeThunk, 8_2_013297A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329780 NtMapViewOfSection,LdrInitializeThunk, 8_2_01329780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329FE0 NtCreateMutant,LdrInitializeThunk, 8_2_01329FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329660 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_01329660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013296E0 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_013296E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329950 NtQueueApcThread, 8_2_01329950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013299D0 NtCreateProcessEx, 8_2_013299D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329820 NtEnumerateKey, 8_2_01329820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0132B040 NtSuspendThread, 8_2_0132B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013298A0 NtWriteVirtualMemory, 8_2_013298A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329B00 NtSetValueKey, 8_2_01329B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0132A3B0 NtGetContextThread, 8_2_0132A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329A10 NtQuerySection, 8_2_01329A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329A80 NtOpenDirectoryObject, 8_2_01329A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0132AD30 NtSetContextThread, 8_2_0132AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329520 NtWaitForSingleObject, 8_2_01329520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329560 NtWriteFile, 8_2_01329560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013295F0 NtQueryInformationFile, 8_2_013295F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329730 NtQueryVirtualMemory, 8_2_01329730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0132A710 NtOpenProcessToken, 8_2_0132A710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329770 NtSetInformationFile, 8_2_01329770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0132A770 NtOpenThread, 8_2_0132A770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329760 NtOpenProcess, 8_2_01329760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329610 NtEnumerateValueKey, 8_2_01329610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329670 NtQueryInformationProcess, 8_2_01329670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01329650 NtQueryValueKey, 8_2_01329650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013296D0 NtCreateKey, 8_2_013296D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619540 NtReadFile,LdrInitializeThunk, 10_2_05619540
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619910 NtAdjustPrivilegesToken,LdrInitializeThunk, 10_2_05619910
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056195D0 NtClose,LdrInitializeThunk, 10_2_056195D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056199A0 NtCreateSection,LdrInitializeThunk, 10_2_056199A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619860 NtQuerySystemInformation,LdrInitializeThunk, 10_2_05619860
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619840 NtDelayExecution,LdrInitializeThunk, 10_2_05619840
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619710 NtQueryInformationToken,LdrInitializeThunk, 10_2_05619710
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619FE0 NtCreateMutant,LdrInitializeThunk, 10_2_05619FE0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619780 NtMapViewOfSection,LdrInitializeThunk, 10_2_05619780
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619660 NtAllocateVirtualMemory,LdrInitializeThunk, 10_2_05619660
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619650 NtQueryValueKey,LdrInitializeThunk, 10_2_05619650
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619A50 NtCreateFile,LdrInitializeThunk, 10_2_05619A50
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056196E0 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_056196E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056196D0 NtCreateKey,LdrInitializeThunk, 10_2_056196D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619560 NtWriteFile, 10_2_05619560
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619950 NtQueueApcThread, 10_2_05619950
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619520 NtWaitForSingleObject, 10_2_05619520
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0561AD30 NtSetContextThread, 10_2_0561AD30
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056195F0 NtQueryInformationFile, 10_2_056195F0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056199D0 NtCreateProcessEx, 10_2_056199D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0561B040 NtSuspendThread, 10_2_0561B040
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619820 NtEnumerateKey, 10_2_05619820
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056198F0 NtReadVirtualMemory, 10_2_056198F0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056198A0 NtWriteVirtualMemory, 10_2_056198A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619760 NtOpenProcess, 10_2_05619760
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619770 NtSetInformationFile, 10_2_05619770
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0561A770 NtOpenThread, 10_2_0561A770
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619730 NtQueryVirtualMemory, 10_2_05619730
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619B00 NtSetValueKey, 10_2_05619B00
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0561A710 NtOpenProcessToken, 10_2_0561A710
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056197A0 NtUnmapViewOfSection, 10_2_056197A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0561A3B0 NtGetContextThread, 10_2_0561A3B0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619670 NtQueryInformationProcess, 10_2_05619670
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619A20 NtResumeThread, 10_2_05619A20
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619A00 NtProtectVirtualMemory, 10_2_05619A00
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619610 NtEnumerateValueKey, 10_2_05619610
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619A10 NtQuerySection, 10_2_05619A10
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05619A80 NtOpenDirectoryObject, 10_2_05619A80
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A8300 NtClose, 10_2_033A8300
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A83B0 NtAllocateVirtualMemory, 10_2_033A83B0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A8280 NtReadFile, 10_2_033A8280
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A81D0 NtCreateFile, 10_2_033A81D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A83AA NtAllocateVirtualMemory, 10_2_033A83AA
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A82FA NtClose, 10_2_033A82FA
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A81CD NtCreateFile, 10_2_033A81CD
Detected potential crypto function
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D31A8 0_2_019D31A8
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D10C8 0_2_019D10C8
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D22A8 0_2_019D22A8
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D1880 0_2_019D1880
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D5A50 0_2_019D5A50
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D1D60 0_2_019D1D60
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D41B8 0_2_019D41B8
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D41A8 0_2_019D41A8
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D30B1 0_2_019D30B1
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D1016 0_2_019D1016
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D5038 0_2_019D5038
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D5048 0_2_019D5048
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D53F8 0_2_019D53F8
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D229A 0_2_019D229A
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D0480 0_2_019D0480
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D5408 0_2_019D5408
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D0472 0_2_019D0472
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D3691 0_2_019D3691
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D36A0 0_2_019D36A0
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D5619 0_2_019D5619
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D5628 0_2_019D5628
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D5888 0_2_019D5888
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D5878 0_2_019D5878
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D1870 0_2_019D1870
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D5A40 0_2_019D5A40
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D4D30 0_2_019D4D30
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D4D20 0_2_019D4D20
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D1D51 0_2_019D1D51
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05903FD0 0_2_05903FD0
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05900980 0_2_05900980
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_0590602D 0_2_0590602D
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05901446 0_2_05901446
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05903FC0 0_2_05903FC0
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05901629 0_2_05901629
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05900E50 0_2_05900E50
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05901980 0_2_05901980
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_059019B0 0_2_059019B0
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05900970 0_2_05900970
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_059000FF 0_2_059000FF
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05900007 0_2_05900007
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05900040 0_2_05900040
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05901390 0_2_05901390
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_0590138A 0_2_0590138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00401030 8_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00401174 8_2_00401174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004012FB 8_2_004012FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041A302 8_2_0041A302
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041CBDF 8_2_0041CBDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041CBF8 8_2_0041CBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00408C6B 8_2_00408C6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00408C70 8_2_00408C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041B4B6 8_2_0041B4B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00402D87 8_2_00402D87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00402D90 8_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041B67D 8_2_0041B67D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041CF41 8_2_0041CF41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041B76D 8_2_0041B76D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00402FB0 8_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01304120 8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012EF900 8_2_012EF900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1002 8_2_013A1002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012FB090 8_2_012FB090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0131EBB0 8_2_0131EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E0D20 8_2_012E0D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B1D55 8_2_013B1D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01306E30 8_2_01306E30
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A1D55 10_2_056A1D55
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DF900 10_2_055DF900
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D0D20 10_2_055D0D20
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F4120 10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055ED5E0 10_2_055ED5E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E841F 10_2_055E841F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691002 10_2_05691002
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055EB090 10_2_055EB090
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560EBB0 10_2_0560EBB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F6E30 10_2_055F6E30
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033AA302 10_2_033AA302
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033ACBF8 10_2_033ACBF8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033ACBDF 10_2_033ACBDF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033ACF41 10_2_033ACF41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_03392FB0 10_2_03392FB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033AB67D 10_2_033AB67D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_03392D90 10_2_03392D90
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_03392D87 10_2_03392D87
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_03398C70 10_2_03398C70
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_03398C6B 10_2_03398C6B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033AB4B6 10_2_033AB4B6
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 055DB150 appears 32 times
PE file contains strange resources
Source: PI-0387991.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: PI-0387991.exe, 00000000.00000000.228213118.000000000106D000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameCVhq8.exe2 vs PI-0387991.exe
Source: PI-0387991.exe, 00000000.00000002.326381081.0000000005F20000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameResource_Meter.dll> vs PI-0387991.exe
Source: PI-0387991.exe, 00000000.00000002.325475852.0000000005860000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs PI-0387991.exe
Source: PI-0387991.exe, 00000000.00000002.330341241.0000000007E90000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs PI-0387991.exe
Source: PI-0387991.exe Binary or memory string: OriginalFilenameCVhq8.exe2 vs PI-0387991.exe
Uses 32bit PE files
Source: PI-0387991.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: PI-0387991.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@5/3
Source: C:\Users\user\Desktop\PI-0387991.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PI-0387991.exe.log Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Mutant created: \Sessions\1\BaseNamedObjects\QXSFoHSgVnhv
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1064:120:WilError_01
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: PI-0387991.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PI-0387991.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: PI-0387991.exe Virustotal: Detection: 50%
Source: PI-0387991.exe ReversingLabs: Detection: 43%
Source: unknown Process created: C:\Users\user\Desktop\PI-0387991.exe 'C:\Users\user\Desktop\PI-0387991.exe'
Source: C:\Users\user\Desktop\PI-0387991.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PI-0387991.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path} Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: PI-0387991.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PI-0387991.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: explorer.pdbUGP source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000009.00000000.342044175.0000000006FE0000.00000002.00000001.sdmp
Source: Binary string: RegSvcs.pdb, source: explorer.exe, 0000000A.00000002.501905978.0000000005AE7000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, explorer.exe, 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: RegSvcs.exe, explorer.exe
Source: Binary string: explorer.pdb source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp
Source: Binary string: RegSvcs.pdb source: explorer.exe, 0000000A.00000002.501905978.0000000005AE7000.00000004.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000009.00000000.342044175.0000000006FE0000.00000002.00000001.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: PI-0387991.exe, uNotepad/Form1.cs .Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.PI-0387991.exe.f90000.0.unpack, uNotepad/Form1.cs .Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.PI-0387991.exe.f90000.0.unpack, uNotepad/Form1.cs .Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_00FEE9EE push ss; iretd 0_2_00FEE9F4
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_019D61E9 push ebx; iretd 0_2_019D61EA
Source: C:\Users\user\Desktop\PI-0387991.exe Code function: 0_2_05909235 push FFFFFF8Bh; iretd 0_2_05909237
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004161E2 push ecx; iretd 8_2_004161E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041C309 pushfd ; iretd 8_2_0041C30A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041B3C5 push eax; ret 8_2_0041B418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041B47C push eax; ret 8_2_0041B482
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041B412 push eax; ret 8_2_0041B418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0041B41B push eax; ret 8_2_0041B482
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00415F53 pushfd ; iretd 8_2_00415F86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004157CE push edi; ret 8_2_004157D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00415F93 pushfd ; iretd 8_2_00415F86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0133D0D1 push ecx; ret 8_2_0133D0E4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0562D0D1 push ecx; ret 10_2_0562D0E4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033AC309 pushfd ; iretd 10_2_033AC30A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033AB3C5 push eax; ret 10_2_033AB418
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A61E2 push ecx; iretd 10_2_033A61E3
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A5F53 pushfd ; iretd 10_2_033A5F86
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A5F93 pushfd ; iretd 10_2_033A5F86
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033A57CE push edi; ret 10_2_033A57D4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033AB41B push eax; ret 10_2_033AB482
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033AB412 push eax; ret 10_2_033AB418
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_033AB47C push eax; ret 10_2_033AB482
Source: initial sample Static PE information: section name: .text entropy: 7.71928782893
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PI-0387991.exe PID: 5736, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe RDTSC instruction interceptor: First address: 00000000033985F4 second address: 00000000033985FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe RDTSC instruction interceptor: First address: 000000000339898E second address: 0000000003398994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004088C0 rdtsc 8_2_004088C0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PI-0387991.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PI-0387991.exe TID: 1456 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\PI-0387991.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000009.00000000.346102181.000000000891C000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: explorer.exe, 00000009.00000000.345439561.0000000008270000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000009.00000000.360069289.0000000003710000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000009.00000000.328026407.0000000003767000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: explorer.exe, 00000009.00000000.356898558.00000000011B3000.00000004.00000020.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000009.00000000.346165392.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000009.00000000.345439561.0000000008270000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000009.00000000.366899720.00000000053C4000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000009.00000000.345439561.0000000008270000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000009.00000000.346165392.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000009.00000000.345439561.0000000008270000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\PI-0387991.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_004088C0 rdtsc 8_2_004088C0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_00409B30 LdrLoadDll, 8_2_00409B30
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01304120 mov eax, dword ptr fs:[00000030h] 8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01304120 mov eax, dword ptr fs:[00000030h] 8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01304120 mov eax, dword ptr fs:[00000030h] 8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01304120 mov eax, dword ptr fs:[00000030h] 8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01304120 mov ecx, dword ptr fs:[00000030h] 8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E9100 mov eax, dword ptr fs:[00000030h] 8_2_012E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E9100 mov eax, dword ptr fs:[00000030h] 8_2_012E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E9100 mov eax, dword ptr fs:[00000030h] 8_2_012E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012EB171 mov eax, dword ptr fs:[00000030h] 8_2_012EB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012EB171 mov eax, dword ptr fs:[00000030h] 8_2_012EB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0130B944 mov eax, dword ptr fs:[00000030h] 8_2_0130B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0130B944 mov eax, dword ptr fs:[00000030h] 8_2_0130B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0130C182 mov eax, dword ptr fs:[00000030h] 8_2_0130C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0131A185 mov eax, dword ptr fs:[00000030h] 8_2_0131A185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012EB1E1 mov eax, dword ptr fs:[00000030h] 8_2_012EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012EB1E1 mov eax, dword ptr fs:[00000030h] 8_2_012EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012EB1E1 mov eax, dword ptr fs:[00000030h] 8_2_012EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012FB02A mov eax, dword ptr fs:[00000030h] 8_2_012FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012FB02A mov eax, dword ptr fs:[00000030h] 8_2_012FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012FB02A mov eax, dword ptr fs:[00000030h] 8_2_012FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012FB02A mov eax, dword ptr fs:[00000030h] 8_2_012FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01367016 mov eax, dword ptr fs:[00000030h] 8_2_01367016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01367016 mov eax, dword ptr fs:[00000030h] 8_2_01367016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01367016 mov eax, dword ptr fs:[00000030h] 8_2_01367016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A2073 mov eax, dword ptr fs:[00000030h] 8_2_013A2073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B1074 mov eax, dword ptr fs:[00000030h] 8_2_013B1074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0131F0BF mov ecx, dword ptr fs:[00000030h] 8_2_0131F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0131F0BF mov eax, dword ptr fs:[00000030h] 8_2_0131F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0131F0BF mov eax, dword ptr fs:[00000030h] 8_2_0131F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013290AF mov eax, dword ptr fs:[00000030h] 8_2_013290AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E9080 mov eax, dword ptr fs:[00000030h] 8_2_012E9080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A131B mov eax, dword ptr fs:[00000030h] 8_2_013A131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B8B58 mov eax, dword ptr fs:[00000030h] 8_2_013B8B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B5BA5 mov eax, dword ptr fs:[00000030h] 8_2_013B5BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A138A mov eax, dword ptr fs:[00000030h] 8_2_013A138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0139B260 mov eax, dword ptr fs:[00000030h] 8_2_0139B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0139B260 mov eax, dword ptr fs:[00000030h] 8_2_0139B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E9240 mov eax, dword ptr fs:[00000030h] 8_2_012E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E9240 mov eax, dword ptr fs:[00000030h] 8_2_012E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E9240 mov eax, dword ptr fs:[00000030h] 8_2_012E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E9240 mov eax, dword ptr fs:[00000030h] 8_2_012E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E52A5 mov eax, dword ptr fs:[00000030h] 8_2_012E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E52A5 mov eax, dword ptr fs:[00000030h] 8_2_012E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E52A5 mov eax, dword ptr fs:[00000030h] 8_2_012E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E52A5 mov eax, dword ptr fs:[00000030h] 8_2_012E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E52A5 mov eax, dword ptr fs:[00000030h] 8_2_012E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0131D294 mov eax, dword ptr fs:[00000030h] 8_2_0131D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0131D294 mov eax, dword ptr fs:[00000030h] 8_2_0131D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B8D34 mov eax, dword ptr fs:[00000030h] 8_2_013B8D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012EAD30 mov eax, dword ptr fs:[00000030h] 8_2_012EAD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0130C577 mov eax, dword ptr fs:[00000030h] 8_2_0130C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0130C577 mov eax, dword ptr fs:[00000030h] 8_2_0130C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01307D50 mov eax, dword ptr fs:[00000030h] 8_2_01307D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01323D43 mov eax, dword ptr fs:[00000030h] 8_2_01323D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013135A1 mov eax, dword ptr fs:[00000030h] 8_2_013135A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E2D8A mov eax, dword ptr fs:[00000030h] 8_2_012E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E2D8A mov eax, dword ptr fs:[00000030h] 8_2_012E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E2D8A mov eax, dword ptr fs:[00000030h] 8_2_012E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E2D8A mov eax, dword ptr fs:[00000030h] 8_2_012E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E2D8A mov eax, dword ptr fs:[00000030h] 8_2_012E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_01398DF1 mov eax, dword ptr fs:[00000030h] 8_2_01398DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0131BC2C mov eax, dword ptr fs:[00000030h] 8_2_0131BC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B740D mov eax, dword ptr fs:[00000030h] 8_2_013B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B740D mov eax, dword ptr fs:[00000030h] 8_2_013B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B740D mov eax, dword ptr fs:[00000030h] 8_2_013B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h] 8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0130746D mov eax, dword ptr fs:[00000030h] 8_2_0130746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013A14FB mov eax, dword ptr fs:[00000030h] 8_2_013A14FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B8CD6 mov eax, dword ptr fs:[00000030h] 8_2_013B8CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E4F2E mov eax, dword ptr fs:[00000030h] 8_2_012E4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012E4F2E mov eax, dword ptr fs:[00000030h] 8_2_012E4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0131E730 mov eax, dword ptr fs:[00000030h] 8_2_0131E730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0137FF10 mov eax, dword ptr fs:[00000030h] 8_2_0137FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0137FF10 mov eax, dword ptr fs:[00000030h] 8_2_0137FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B070D mov eax, dword ptr fs:[00000030h] 8_2_013B070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B070D mov eax, dword ptr fs:[00000030h] 8_2_013B070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B8F6A mov eax, dword ptr fs:[00000030h] 8_2_013B8F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_012FEF40 mov eax, dword ptr fs:[00000030h] 8_2_012FEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0139FE3F mov eax, dword ptr fs:[00000030h] 8_2_0139FE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013646A7 mov eax, dword ptr fs:[00000030h] 8_2_013646A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B0EA5 mov eax, dword ptr fs:[00000030h] 8_2_013B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B0EA5 mov eax, dword ptr fs:[00000030h] 8_2_013B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B0EA5 mov eax, dword ptr fs:[00000030h] 8_2_013B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0137FE87 mov eax, dword ptr fs:[00000030h] 8_2_0137FE87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013116E0 mov ecx, dword ptr fs:[00000030h] 8_2_013116E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013B8ED6 mov eax, dword ptr fs:[00000030h] 8_2_013B8ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_0139FEC0 mov eax, dword ptr fs:[00000030h] 8_2_0139FEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 8_2_013136CC mov eax, dword ptr fs:[00000030h] 8_2_013136CC
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F7D50 mov eax, dword ptr fs:[00000030h] 10_2_055F7D50
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FB944 mov eax, dword ptr fs:[00000030h] 10_2_055FB944
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FB944 mov eax, dword ptr fs:[00000030h] 10_2_055FB944
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05613D43 mov eax, dword ptr fs:[00000030h] 10_2_05613D43
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05653540 mov eax, dword ptr fs:[00000030h] 10_2_05653540
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FC577 mov eax, dword ptr fs:[00000030h] 10_2_055FC577
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FC577 mov eax, dword ptr fs:[00000030h] 10_2_055FC577
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DB171 mov eax, dword ptr fs:[00000030h] 10_2_055DB171
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DB171 mov eax, dword ptr fs:[00000030h] 10_2_055DB171
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DC962 mov eax, dword ptr fs:[00000030h] 10_2_055DC962
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0565A537 mov eax, dword ptr fs:[00000030h] 10_2_0565A537
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560513A mov eax, dword ptr fs:[00000030h] 10_2_0560513A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560513A mov eax, dword ptr fs:[00000030h] 10_2_0560513A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05604D3B mov eax, dword ptr fs:[00000030h] 10_2_05604D3B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05604D3B mov eax, dword ptr fs:[00000030h] 10_2_05604D3B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05604D3B mov eax, dword ptr fs:[00000030h] 10_2_05604D3B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D9100 mov eax, dword ptr fs:[00000030h] 10_2_055D9100
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D9100 mov eax, dword ptr fs:[00000030h] 10_2_055D9100
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D9100 mov eax, dword ptr fs:[00000030h] 10_2_055D9100
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A8D34 mov eax, dword ptr fs:[00000030h] 10_2_056A8D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h] 10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DAD30 mov eax, dword ptr fs:[00000030h] 10_2_055DAD30
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F4120 mov eax, dword ptr fs:[00000030h] 10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F4120 mov eax, dword ptr fs:[00000030h] 10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F4120 mov eax, dword ptr fs:[00000030h] 10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F4120 mov eax, dword ptr fs:[00000030h] 10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F4120 mov ecx, dword ptr fs:[00000030h] 10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056641E8 mov eax, dword ptr fs:[00000030h] 10_2_056641E8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05688DF1 mov eax, dword ptr fs:[00000030h] 10_2_05688DF1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DB1E1 mov eax, dword ptr fs:[00000030h] 10_2_055DB1E1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DB1E1 mov eax, dword ptr fs:[00000030h] 10_2_055DB1E1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DB1E1 mov eax, dword ptr fs:[00000030h] 10_2_055DB1E1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055ED5E0 mov eax, dword ptr fs:[00000030h] 10_2_055ED5E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055ED5E0 mov eax, dword ptr fs:[00000030h] 10_2_055ED5E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056061A0 mov eax, dword ptr fs:[00000030h] 10_2_056061A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056061A0 mov eax, dword ptr fs:[00000030h] 10_2_056061A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056035A1 mov eax, dword ptr fs:[00000030h] 10_2_056035A1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056569A6 mov eax, dword ptr fs:[00000030h] 10_2_056569A6
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05601DB5 mov eax, dword ptr fs:[00000030h] 10_2_05601DB5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05601DB5 mov eax, dword ptr fs:[00000030h] 10_2_05601DB5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05601DB5 mov eax, dword ptr fs:[00000030h] 10_2_05601DB5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D2D8A mov eax, dword ptr fs:[00000030h] 10_2_055D2D8A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D2D8A mov eax, dword ptr fs:[00000030h] 10_2_055D2D8A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D2D8A mov eax, dword ptr fs:[00000030h] 10_2_055D2D8A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D2D8A mov eax, dword ptr fs:[00000030h] 10_2_055D2D8A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D2D8A mov eax, dword ptr fs:[00000030h] 10_2_055D2D8A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056551BE mov eax, dword ptr fs:[00000030h] 10_2_056551BE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056551BE mov eax, dword ptr fs:[00000030h] 10_2_056551BE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056551BE mov eax, dword ptr fs:[00000030h] 10_2_056551BE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056551BE mov eax, dword ptr fs:[00000030h] 10_2_056551BE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FC182 mov eax, dword ptr fs:[00000030h] 10_2_055FC182
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560A185 mov eax, dword ptr fs:[00000030h] 10_2_0560A185
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05602990 mov eax, dword ptr fs:[00000030h] 10_2_05602990
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560FD9B mov eax, dword ptr fs:[00000030h] 10_2_0560FD9B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560FD9B mov eax, dword ptr fs:[00000030h] 10_2_0560FD9B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F0050 mov eax, dword ptr fs:[00000030h] 10_2_055F0050
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F0050 mov eax, dword ptr fs:[00000030h] 10_2_055F0050
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05692073 mov eax, dword ptr fs:[00000030h] 10_2_05692073
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A1074 mov eax, dword ptr fs:[00000030h] 10_2_056A1074
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560A44B mov eax, dword ptr fs:[00000030h] 10_2_0560A44B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F746D mov eax, dword ptr fs:[00000030h] 10_2_055F746D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566C450 mov eax, dword ptr fs:[00000030h] 10_2_0566C450
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566C450 mov eax, dword ptr fs:[00000030h] 10_2_0566C450
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560BC2C mov eax, dword ptr fs:[00000030h] 10_2_0560BC2C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560002D mov eax, dword ptr fs:[00000030h] 10_2_0560002D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560002D mov eax, dword ptr fs:[00000030h] 10_2_0560002D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560002D mov eax, dword ptr fs:[00000030h] 10_2_0560002D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560002D mov eax, dword ptr fs:[00000030h] 10_2_0560002D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560002D mov eax, dword ptr fs:[00000030h] 10_2_0560002D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A740D mov eax, dword ptr fs:[00000030h] 10_2_056A740D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A740D mov eax, dword ptr fs:[00000030h] 10_2_056A740D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A740D mov eax, dword ptr fs:[00000030h] 10_2_056A740D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h] 10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05656C0A mov eax, dword ptr fs:[00000030h] 10_2_05656C0A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05656C0A mov eax, dword ptr fs:[00000030h] 10_2_05656C0A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05656C0A mov eax, dword ptr fs:[00000030h] 10_2_05656C0A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05656C0A mov eax, dword ptr fs:[00000030h] 10_2_05656C0A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05657016 mov eax, dword ptr fs:[00000030h] 10_2_05657016
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05657016 mov eax, dword ptr fs:[00000030h] 10_2_05657016
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05657016 mov eax, dword ptr fs:[00000030h] 10_2_05657016
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055EB02A mov eax, dword ptr fs:[00000030h] 10_2_055EB02A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055EB02A mov eax, dword ptr fs:[00000030h] 10_2_055EB02A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055EB02A mov eax, dword ptr fs:[00000030h] 10_2_055EB02A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055EB02A mov eax, dword ptr fs:[00000030h] 10_2_055EB02A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A4015 mov eax, dword ptr fs:[00000030h] 10_2_056A4015
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A4015 mov eax, dword ptr fs:[00000030h] 10_2_056A4015
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056914FB mov eax, dword ptr fs:[00000030h] 10_2_056914FB
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05656CF0 mov eax, dword ptr fs:[00000030h] 10_2_05656CF0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05656CF0 mov eax, dword ptr fs:[00000030h] 10_2_05656CF0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05656CF0 mov eax, dword ptr fs:[00000030h] 10_2_05656CF0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566B8D0 mov ecx, dword ptr fs:[00000030h] 10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A8CD6 mov eax, dword ptr fs:[00000030h] 10_2_056A8CD6
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E849B mov eax, dword ptr fs:[00000030h] 10_2_055E849B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056190AF mov eax, dword ptr fs:[00000030h] 10_2_056190AF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D9080 mov eax, dword ptr fs:[00000030h] 10_2_055D9080
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560F0BF mov ecx, dword ptr fs:[00000030h] 10_2_0560F0BF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560F0BF mov eax, dword ptr fs:[00000030h] 10_2_0560F0BF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560F0BF mov eax, dword ptr fs:[00000030h] 10_2_0560F0BF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05653884 mov eax, dword ptr fs:[00000030h] 10_2_05653884
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05653884 mov eax, dword ptr fs:[00000030h] 10_2_05653884
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A8F6A mov eax, dword ptr fs:[00000030h] 10_2_056A8F6A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DF358 mov eax, dword ptr fs:[00000030h] 10_2_055DF358
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05603B7A mov eax, dword ptr fs:[00000030h] 10_2_05603B7A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05603B7A mov eax, dword ptr fs:[00000030h] 10_2_05603B7A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DDB40 mov eax, dword ptr fs:[00000030h] 10_2_055DDB40
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055EEF40 mov eax, dword ptr fs:[00000030h] 10_2_055EEF40
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A8B58 mov eax, dword ptr fs:[00000030h] 10_2_056A8B58
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DDB60 mov ecx, dword ptr fs:[00000030h] 10_2_055DDB60
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055EFF60 mov eax, dword ptr fs:[00000030h] 10_2_055EFF60
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FF716 mov eax, dword ptr fs:[00000030h] 10_2_055FF716
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560E730 mov eax, dword ptr fs:[00000030h] 10_2_0560E730
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A070D mov eax, dword ptr fs:[00000030h] 10_2_056A070D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A070D mov eax, dword ptr fs:[00000030h] 10_2_056A070D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560A70E mov eax, dword ptr fs:[00000030h] 10_2_0560A70E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560A70E mov eax, dword ptr fs:[00000030h] 10_2_0560A70E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0569131B mov eax, dword ptr fs:[00000030h] 10_2_0569131B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D4F2E mov eax, dword ptr fs:[00000030h] 10_2_055D4F2E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D4F2E mov eax, dword ptr fs:[00000030h] 10_2_055D4F2E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566FF10 mov eax, dword ptr fs:[00000030h] 10_2_0566FF10
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566FF10 mov eax, dword ptr fs:[00000030h] 10_2_0566FF10
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h] 10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h] 10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h] 10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h] 10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h] 10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h] 10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056137F5 mov eax, dword ptr fs:[00000030h] 10_2_056137F5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056553CA mov eax, dword ptr fs:[00000030h] 10_2_056553CA
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056553CA mov eax, dword ptr fs:[00000030h] 10_2_056553CA
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E8794 mov eax, dword ptr fs:[00000030h] 10_2_055E8794
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A5BA5 mov eax, dword ptr fs:[00000030h] 10_2_056A5BA5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E1B8F mov eax, dword ptr fs:[00000030h] 10_2_055E1B8F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E1B8F mov eax, dword ptr fs:[00000030h] 10_2_055E1B8F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0569138A mov eax, dword ptr fs:[00000030h] 10_2_0569138A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0568D380 mov ecx, dword ptr fs:[00000030h] 10_2_0568D380
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560B390 mov eax, dword ptr fs:[00000030h] 10_2_0560B390
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05657794 mov eax, dword ptr fs:[00000030h] 10_2_05657794
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05657794 mov eax, dword ptr fs:[00000030h] 10_2_05657794
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05657794 mov eax, dword ptr fs:[00000030h] 10_2_05657794
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0568B260 mov eax, dword ptr fs:[00000030h] 10_2_0568B260
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0568B260 mov eax, dword ptr fs:[00000030h] 10_2_0568B260
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A8A62 mov eax, dword ptr fs:[00000030h] 10_2_056A8A62
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0561927A mov eax, dword ptr fs:[00000030h] 10_2_0561927A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D9240 mov eax, dword ptr fs:[00000030h] 10_2_055D9240
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D9240 mov eax, dword ptr fs:[00000030h] 10_2_055D9240
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D9240 mov eax, dword ptr fs:[00000030h] 10_2_055D9240
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D9240 mov eax, dword ptr fs:[00000030h] 10_2_055D9240
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h] 10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h] 10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h] 10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h] 10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h] 10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h] 10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FAE73 mov eax, dword ptr fs:[00000030h] 10_2_055FAE73
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FAE73 mov eax, dword ptr fs:[00000030h] 10_2_055FAE73
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FAE73 mov eax, dword ptr fs:[00000030h] 10_2_055FAE73
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FAE73 mov eax, dword ptr fs:[00000030h] 10_2_055FAE73
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055FAE73 mov eax, dword ptr fs:[00000030h] 10_2_055FAE73
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05664257 mov eax, dword ptr fs:[00000030h] 10_2_05664257
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E766D mov eax, dword ptr fs:[00000030h] 10_2_055E766D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055F3A1C mov eax, dword ptr fs:[00000030h] 10_2_055F3A1C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DAA16 mov eax, dword ptr fs:[00000030h] 10_2_055DAA16
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DAA16 mov eax, dword ptr fs:[00000030h] 10_2_055DAA16
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E8A0A mov eax, dword ptr fs:[00000030h] 10_2_055E8A0A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0568FE3F mov eax, dword ptr fs:[00000030h] 10_2_0568FE3F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DC600 mov eax, dword ptr fs:[00000030h] 10_2_055DC600
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DC600 mov eax, dword ptr fs:[00000030h] 10_2_055DC600
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DC600 mov eax, dword ptr fs:[00000030h] 10_2_055DC600
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05608E00 mov eax, dword ptr fs:[00000030h] 10_2_05608E00
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560A61C mov eax, dword ptr fs:[00000030h] 10_2_0560A61C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560A61C mov eax, dword ptr fs:[00000030h] 10_2_0560A61C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055DE620 mov eax, dword ptr fs:[00000030h] 10_2_055DE620
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056016E0 mov ecx, dword ptr fs:[00000030h] 10_2_056016E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05602AE4 mov eax, dword ptr fs:[00000030h] 10_2_05602AE4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05618EC7 mov eax, dword ptr fs:[00000030h] 10_2_05618EC7
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0568FEC0 mov eax, dword ptr fs:[00000030h] 10_2_0568FEC0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_05602ACB mov eax, dword ptr fs:[00000030h] 10_2_05602ACB
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056036CC mov eax, dword ptr fs:[00000030h] 10_2_056036CC
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A8ED6 mov eax, dword ptr fs:[00000030h] 10_2_056A8ED6
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055E76E2 mov eax, dword ptr fs:[00000030h] 10_2_055E76E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056546A7 mov eax, dword ptr fs:[00000030h] 10_2_056546A7
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A0EA5 mov eax, dword ptr fs:[00000030h] 10_2_056A0EA5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A0EA5 mov eax, dword ptr fs:[00000030h] 10_2_056A0EA5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_056A0EA5 mov eax, dword ptr fs:[00000030h] 10_2_056A0EA5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560FAB0 mov eax, dword ptr fs:[00000030h] 10_2_0560FAB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0566FE87 mov eax, dword ptr fs:[00000030h] 10_2_0566FE87
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055EAAB0 mov eax, dword ptr fs:[00000030h] 10_2_055EAAB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055EAAB0 mov eax, dword ptr fs:[00000030h] 10_2_055EAAB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560D294 mov eax, dword ptr fs:[00000030h] 10_2_0560D294
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_0560D294 mov eax, dword ptr fs:[00000030h] 10_2_0560D294
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D52A5 mov eax, dword ptr fs:[00000030h] 10_2_055D52A5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D52A5 mov eax, dword ptr fs:[00000030h] 10_2_055D52A5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D52A5 mov eax, dword ptr fs:[00000030h] 10_2_055D52A5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D52A5 mov eax, dword ptr fs:[00000030h] 10_2_055D52A5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 10_2_055D52A5 mov eax, dword ptr fs:[00000030h] 10_2_055D52A5
Enables debug privileges
Source: C:\Users\user\Desktop\PI-0387991.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.siteoficial-liquida.com
Source: C:\Windows\explorer.exe Domain query: www.idookap.com
Source: C:\Windows\explorer.exe Domain query: www.romahony.com
Source: C:\Windows\explorer.exe Network Connect: 162.241.2.50 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 103.120.82.56 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.bodymoisturizer.online
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PI-0387991.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Thread register set: target process: 3472 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Section unmapped: C:\Windows\SysWOW64\explorer.exe base address: F20000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\PI-0387991.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: BFA008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PI-0387991.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path} Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' Jump to behavior
Source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp, explorer.exe, 00000009.00000000.346207421.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000002.499737802.0000000003E60000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000009.00000000.325488845.0000000001640000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000002.499737802.0000000003E60000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000009.00000000.325488845.0000000001640000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000002.499737802.0000000003E60000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp Binary or memory string: Microsoft-Reserved-24C26ACC-DE62-4303-88AD-6CD4F1447F18SecurityConfigureWindowsPasswordsProxy DesktopProgmanSoftware\Microsoft\Windows NT\CurrentVersion\WinlogonShellSoftware\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells\AvailableShells
Source: explorer.exe, 00000009.00000000.325122928.0000000001128000.00000004.00000020.sdmp Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000009.00000000.325488845.0000000001640000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000002.499737802.0000000003E60000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000009.00000000.325488845.0000000001640000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000002.499737802.0000000003E60000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Users\user\Desktop\PI-0387991.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 452542 Sample: PI-0387991.exe Startdate: 22/07/2021 Architecture: WINDOWS Score: 100 31 www.hispanicassoclv.com 2->31 33 hispanicassoclv.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 7 other signatures 2->47 11 PI-0387991.exe 3 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\PI-0387991.exe.log, ASCII 11->29 dropped 57 Writes to foreign memory regions 11->57 59 Injects a PE file into a foreign processes 11->59 15 RegSvcs.exe 11->15         started        signatures6 process7 signatures8 61 Modifies the context of a thread in another process (thread injection) 15->61 63 Maps a DLL or memory area into another process 15->63 65 Sample uses process hollowing technique 15->65 67 2 other signatures 15->67 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.romahony.com 103.120.82.56, 49694, 80 WEST263GO-HKWest263InternationalLimitedHK Hong Kong 18->35 37 siteoficial-liquida.com 162.241.2.50, 49696, 80 OIS1US United States 18->37 39 4 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 explorer.exe 18->22         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.120.82.56
 www.romahony.com Hong Kong
139021 WEST263GO-HKWest263InternationalLimitedHK true
34.102.136.180
 hispanicassoclv.com United States
15169 GOOGLEUS false
162.241.2.50
 siteoficial-liquida.com United States
26337 OIS1US true

Contacted Domains

Name IP Active
hispanicassoclv.com 34.102.136.180 true
www.romahony.com 103.120.82.56 true
siteoficial-liquida.com 162.241.2.50 true
idookap.com 34.102.136.180 true
www.siteoficial-liquida.com unknown unknown
www.idookap.com unknown unknown
www.bodymoisturizer.online unknown unknown
www.hispanicassoclv.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.hispanicassoclv.com/q4kr/?m4z=hZWT6D&KdPxHVdh=+adpk/1z85ABQgFM8KoV7nh2RN9wNRyN3NacL4PKZthW2WB1UYKLVSKaUBe2HmITnYf8 false
  • Avira URL Cloud: safe
 unknown
http://www.romahony.com/q4kr/?m4z=hZWT6D&KdPxHVdh=stDcKtJiFThdGrRpndYyQbsbrCSX1QkCWnDTnTci+riMDIV/FP53rWURHHZjowo3ayyv true
  • Avira URL Cloud: safe
 unknown
http://www.siteoficial-liquida.com/q4kr/?KdPxHVdh=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq72D06e9ENr&m4z=hZWT6D true
  • Avira URL Cloud: safe
 unknown
http://www.idookap.com/q4kr/?m4z=hZWT6D&KdPxHVdh=8Twh4s36gZRno0YiIaK1Aog0Jq5SRxj1tGC/kNtcN6cj6UbdIOqmSeR7M7wA7kAlsS0+ false
  • Avira URL Cloud: safe
 unknown
www.bodymoisturizer.online/q4kr/ true
  • Avira URL Cloud: safe
 low